Nginx

Automate TLS certificate enrollment and renewal on Nginx with the Horizon Client.

The Horizon Client automates the full TLS certificate lifecycle on Nginx web servers. The certificate and private key are written to the server's file system and Nginx is restarted automatically after each enrollment or renewal.

Prerequisites

Nginx installed and running
Horizon Client installed and configured (see Installation & Configuration)
A PKI connector configured in Horizon. See Configure SwissSign MPKI.
A certificate profile configured in Horizon. See Certificate Profiles.
An automation policy configured in Horizon. See Automation Policies.
Root or sudo access on the server

Setting up TLS on a new Nginx server

Use init when Nginx does not yet have an HTTPS configuration:

sudo horizon-cli automate init --target=nginx --automation-policy=<policy>

To set up HTTPS on a non-standard port:

sudo horizon-cli automate init --target=nginx --automation-policy=<policy> --port=<port>

Taking control of an existing certificate

Use enroll when Nginx is already serving HTTPS. The client detects the existing certificate from the Nginx configuration, re-enrolls it under the automation policy, and updates the config:

sudo horizon-cli automate enroll --target=nginx --automation-policy=<policy>

To preview what the client finds without making any changes:

sudo horizon-cli automate enroll --target=nginx --automation-policy=<policy> --analyze-only

Scheduled renewal

Once enrolled, run routine to check for and perform renewals:

sudo horizon-cli automate routine

Create a cron job to run this automatically:

sudo horizon-cli automate create-periodic-task

The period can be any value between 1h and 24h. The default is 6h. To remove the cron job:

sudo horizon-cli automate remove-periodic-task

Certificate storage and backup

The certificate chain and private key are stored as separate files on the file system. On each renewal:

The new files replace the current ones.
The previous files are backed up in /opt/horizon/cert/backup/.
The original files from before Horizon took management are always preserved.

To see which certificates are currently managed and find their IDs:

horizon-cli automate list

IDs follow the format <target>-*:<port>, for example nginx-*:443.

To remove a certificate from Horizon management and restore the original, pass the ID from automate list:

sudo horizon-cli automate remove <id> --restore

For trigger-based workflows and other advanced automation configuration, refer to the Evertrust Horizon documentation.