Mengaktifkan SSL di Nginx Tanpa Domain

1. Buat Sertifikat Self-Signed

Jalankan perintah berikut untuk membuat sertifikat SSL yang berlaku 10 tahun:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout /etc/ssl/private/selfsigned.key \
-out /etc/ssl/certs/selfsigned.crt

Common Name (CN): Masukkan IP server, misalnya 10.10.10.25.

2. Buat File Konfigurasi SSL

Buat file konfigurasi tambahan:

sudo nano /etc/nginx/snippets/self-signed.conf

Tambahkan baris berikut:

ssl_certificate /etc/ssl/certs/selfsigned.crt;
ssl_certificate_key /etc/ssl/private/selfsigned.key;

Simpan (CTRL+X, lalu Y, lalu ENTER).

Buat juga snippet setting SSL tambahan:

sudo nano /etc/nginx/snippets/ssl-params.conf

Tambahkan baris berikut:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1h;
ssl_session_tickets off;

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

Simpan (CTRL+X, lalu Y, lalu ENTER).

3. Ubah Konfigurasi Nginx

Edit konfigurasi default Nginx:

sudo nano /etc/nginx/sites-available/default

Ubah konfigurasi menjadi:

server {
    listen 80;
    server_name _;

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name _;

    include snippets/self-signed.conf;
    include snippets/ssl-params.conf;

    root /var/www/html;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }
}

Simpan (CTRL+X, lalu Y, lalu ENTER).

4. Cek dan Restart Nginx

Cek apakah konfigurasi benar:

sudo nginx -t

Jika tidak ada error, restart Nginx:

sudo systemctl reload nginx

5. Coba akses dengan HTTPS

Buka browser dan akses:

https://10.10.10.25

? Browser akan menampilkan "Not Secure" atau "Your connection is not private".

Klik "Advanced" ? "Proceed to 10.10.10.25 (unsafe)" untuk lanjut.