Issues related to http_ssl_module of NGINX and solutions

Common errors

Solution

• For Error 3, install the OpenSSL development library on the server.

• For Errors 1 and 2, verify that OpenSSL is installed on the server, then recompile NGINX with the http_ssl_module enabled.

The following example uses CentOS 8.0 64-bit, NGINX 1.14.1, and OpenSSL 1.1.1k. Adjust the OpenSSL version based on your NGINX version.

1. Check whether the current NGINX version includes the http_ssl_module.

   Run the following command to view the compile parameters of NGINX:

   nginx -V | grep http_ssl_module

   --with-http_ssl_module, the module is already included. Otherwise, you must manually add it.

   Example output:

   [root@xxx ~]# nginx -V
   nginx version: nginx/1.14.1
   built with gcc 8.2.1 20180905 (Red Hat 8.2.1-3) (GCC)
   built with OpenSSL 1.1.1 FIPS  11 Sep 2018 (running with OpenSSL 1.1.1k  FIPS 25 Mar 2021)
   TLS SNI support enabled
   configure arguments: --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-http_auth_request_module --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'

2. Install the OpenSSL development library.

   # For CentOS with OpenSSL 1.1.1k. Select a compatible OpenSSL version based on your NGINX version.
   sudo yum install openssl-devel-1.1.1k

3. Configure and compile NGINX with the http_ssl_module.

   Go to the NGINX source directory. Replace the path with your actual NGINX source path.

   cd /usr/local/nginx/

   ./configure with your original configure arguments from the nginx -V output and add --with-http_ssl_module. You can customize other parameters as needed.

   ./configure <original_configure_arguments> --with-http_ssl_module

   sudo make

   Do not run make install. This overwrites the existing NGINX configuration.

4. Verify that the http_ssl_module is installed. If not, repeat the previous steps.

   nginx -V | grep http_ssl_module

5. Restart NGINX.

   Replace the path with your actual NGINX executable path.

   cd /usr/local/nginx/sbin
   ./nginx -s reload