Guide to Installing a Custom SSL Certificate (Advanced)

This unofficial guide to installing a custom SSL certificate on a ggRock server.

Problem

A custom SSL certificate may be desired based on company policy, or to enhance the security practices of administrators of your ggRock server.

Solution

WARNING:

Future updates to the ggRock product and its dependencies have the potential to revert this change, please prepare to re-implement this change after any ggRock update or OS update is applied.

To install a custom SSL certificate, replace the certificate files in:

/etc/nginx/ssl/private/ggrock-self-signed.key

and

/etc/nginx/ssl/certs/ggrock-self-signed.crt

Once the certificate and key file are in place, simply restart the nginx service from ggRock Settings, or by using the following terminal command:

systemctl restart nginx

or reboot your server to complete the task.

Certificate Type & Specifications

Certificate Type: Self-signed SSL/TLS Certificate (X.509) managed by Nginx.
Format: Both files are standard PEM encoded text files.
Encryption Type: RSA 2048-bit public key with a SHA-256 signature algorithm (sha256WithRSAEncryption).
Passphrase Status: The active private key is unencrypted (no passphrase). This is a critical requirement for ggRock/Nginx, ensuring the server can reboot automatically without getting stuck waiting for manual password entry.

Takeaway for Future Custom Certificates: Any custom certificate we request or generate to replace this must mimic these properties: it must be a PEM-formatted, unencrypted RSA key (2048-bit or higher) to ensure seamless compatibility with the current Nginx setup.

Updated on: 28/07/2026

Was this article helpful?

Thank you!