How to Create TLS on Linux Server: Step-by-Step Guide

Transport Layer Security (TLS) is a cryptographic protocol that provides secure communication over computer networks. It is the successor to SSL (Secure Sockets Layer). It is widely used to encrypt traffic between clients and servers, protecting sensitive data like login credentials, financial transactions, and personal information. TLS is essential for modern websites, applications, and services that require strong encryption and trust. Administrators often create TLS certificates to ensure secure connections.

In this article, we’ll cover how to create TLS on a Linux server. You’ll learn about prerequisites, installation of OpenSSL, generating TLS certificates, configuring them with web servers like Apache and Nginx, enabling strong encryption, troubleshooting, and best practices. By the end, you’ll have a working TLS setup to secure your Linux-based services.

Prerequisites to Create TLS

Before configuring TLS, ensure your system meets these requirements:

• A Linux server (Ubuntu, Debian, CentOS, or RHEL).
• Root or sudo privileges.
• Domain name pointing to your server’s IP.
• Web server (Apache or Nginx installed).
• OpenSSL package installed.

Meeting these prerequisites ensures a smooth TLS configuration process.

Installing OpenSSL on Linux

OpenSSL is the most common tool for creating and managing TLS certificates on Linux.

• On Ubuntu/Debian:

sudo apt update && sudo apt install openssl -y

• On CentOS/RHEL:

sudo yum install openssl -y

Once installed, you can verify the version with:

openssl version

Create TLS Certificate on Linux

TLS requires both a certificate and a private key. You can generate a self-signed TLS certificate for testing, or request one from a Certificate Authority (CA) for production use.

• Step 1: Generate a Private Key

openssl genrsa -out server.key 2048

• Step 2: Create a Certificate Signing Request (CSR)

openssl req -new -key server.key -out server.csr

You’ll be prompted to enter information such as domain name, organization, and country.

• Step 3: Generate a Self-Signed Certificate

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Now you have:

• server.key → Private Key
• server.crt → TLS Certificate

Configuring TLS with Apache on Linux

Apache supports TLS out of the box, making it simple to secure your website with HTTPS. By configuring TLS certificates in Apache, you ensure encrypted communication between the server and clients, protecting sensitive data while improving security, trust, and SEO.

• Enable SSL module:

sudo a2enmod ssl

• Create a new virtual host config:

sudo nano /etc/apache2/sites-available/example-ssl.conf

Example configuration:

<VirtualHost *:443>
    ServerName example.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/server.crt
    SSLCertificateKeyFile /etc/ssl/private/server.key
</VirtualHost>

• Enable the site and restart Apache:

sudo a2ensite example-ssl.conf
sudo systemctl restart apache2

Now Apache serves your site over HTTPS using TLS.

Configuring TLS with Nginx on Linux

Nginx supports TLS by referencing the SSL certificate and private key in its server block. Once enabled, it ensures secure HTTPS connections, protecting data while improving security and trust.

• Edit your Nginx configuration:

sudo nano /etc/nginx/sites-available/example.conf

Example configuration:

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;

    location / {
        root /var/www/html;
        index index.html;
    }
}

• Test configuration and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

Your Nginx server now uses TLS to secure traffic.

Enforcing Strong TLS Security

Once TLS is enabled, you should enforce strong security practices:

• Disable weak SSL protocols (SSLv2, SSLv3, TLS 1.0, TLS 1.1).
• Use only TLS 1.2 and TLS 1.3.
• Enable strong cipher suites.

Example (Nginx TLS security):

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

This ensures your server resists attacks like BEAST, POODLE, and Heartbleed.

Testing TLS Configuration

After setup, test your TLS configuration:

• Check certificate details:

openssl s_client -connect example.com:443

• Use online tools like Qualys SSL Labs to analyze your server’s TLS strength.

Common Issues and Fixes with TLS on Linux

While TLS provides essential security for Linux servers, misconfigurations or missing steps can lead to common problems. Knowing how to fix TLS issues quickly ensures secure, uninterrupted access for users and maintains trust in your website or service.

• Port 443 blocked: TLS traffic uses port 443. Ensure your firewall allows traffic on this port:

sudo ufw allow 443

• Invalid Certificate Error: This occurs if the certificate does not match your domain. Verify the Common Name (CN) or Subject Alternative Name (SAN) fields and reinstall the correct certificate.
• Mixed Content Warning: Happens when some website resources (images, scripts, CSS) are still loaded over HTTP. Update all assets to HTTPS to eliminate this warning.
• Weak Cipher Warning: Security scanners may flag weak ciphers. Update your TLS configuration to allow only strong, modern ciphers and protocols.

For example, in Nginx:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'HIGH:!aNULL:!MD5';

Regular monitoring and proper configuration help prevent these issues and maintain a secure, high-performing TLS setup.

Conclusion

TLS is an essential protocol for securing communication on Linux servers. By generating certificates with OpenSSL, configuring Apache or Nginx, and enforcing strong encryption, you can ensure your website or application runs securely over HTTPS. Regular testing and best practices help maintain high security standards.

Adopting TLS not only protects sensitive data but also improves SEO rankings and user trust. For more advanced configurations and detailed guidance, always refer to the official TLS and OpenSSL documentation