Generate new SSL certificate for nginx

Make sure this SSL certificate do not exist in domain controller.

Make sure the nginx is running before you do some stuff:

systemctl status nginx.service
systemctl restart nginx.service

SSH into your linux server.

Remove any previous generated key:

rm /etc/pki/tls/private/localhost.key

Move to the certs directory:

cd /etc/pki/tls/certs

Create a new key:

make genkey

Enter some content which you can really remember in future:

Verifying - Enter pass phrase:

Check if new key has been generated:

ls /etc/pki/tls/private/localhost.key

Enter a lot of information

Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Output certificate content on screen on copy to the clipboard:

cat localhost.csr

Go to your Windows Server 2012 R2 certificate service:

http://dc.domain.net/certsrv/

Click [Request a certificate]
Click [advanced certificate request]
Click [Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.]

Copy the content from clipboard. Make sure you have no spaces at the end or at the beginning.

Select [Web Server]

Click [Submit]

Click on the [Base 64 encoded] ball

Now [Download certificate]

Write full certificate domain at the file name.

Upload your certificate to linux server.

Go to the certs directory

cd /etc/pki/tls/certs

Copy certificate from uploaded directory:

cp ~/servername.catonrug.net.cer .

Do some renaming:

cd /etc/pki/tls/certs
mv localhost.csr servername.catonrug.net.csr
cd /etc/pki/tls/private/
mv localhost.key servername.catonrug.net.key

Create a backup of key file:

cp servername.catonrug.net.key servername.catonrug.net.key.org

Remove password from key file:

openssl rsa -in servername.catonrug.net.key.org -out servername.catonrug.net.key

Enter same password which you used at beginning:

Enter pass phrase for servername.catonrug.net.key.org:

At success you will get:

writing RSA key

Check existing certificates in nginx.conf

grep ssl /etc/nginx/nginx.conf

Do some replace:

sed -i "s/replace/with/g" /etc/nginx/nginx.conf

Restart nginx:

systemctl status nginx.service
systemctl restart nginx.service