# Install with SSL Certificate

**URL:** <https://forum.ansible.com/t/install-with-ssl-certificate/31177>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [August 30, 2019, 10:10am UTC](https://forum.ansible.com/t/install-with-ssl-certificate/31177 "2019-08-30T10:10:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adam\_Henson](https://avatars.discourse-cdn.com/v4/letter/a/dbc845/32.png) [@Adam\_Henson](https://forum.ansible.com/u/Adam_Henson)\
**Post date:** [August 30, 2019, 10:10am UTC](https://forum.ansible.com/t/install-with-ssl-certificate/31177/1 "2019-08-30T10:10:19Z")

</div>

Hi All,

I am attempting to install AWX and have it run with our own SSL certificate. I have a (PEM) certificate file and a private key. However, whilst I can see the line in the inventory file to specify the ssl\_certificate, I do not see anywhere to specify the private key.

Please advise how to install the latest AWX with my own SSL certificate?

Many thanks.

---

<div class="post-metadata">

**Author:** ![Katsutoshi\_Nakatomi](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Katsutoshi\_Nakatomi](https://forum.ansible.com/u/Katsutoshi_Nakatomi)\
**Post date:** [August 30, 2019, 1:52pm UTC](https://forum.ansible.com/t/install-with-ssl-certificate/31177/2 "2019-08-30T13:52:30Z")

</div>

Hi Adam

I'll write it using google translation

If you can read Japanese or use google translation, please read this page.  
[https://qiita.com/nakacya/items/e17580fb0d94cd4ac6ed](https://qiita.com/nakacya/items/e17580fb0d94cd4ac6ed)

Now, please try the following contents.  
-Added the following to inventory  
/ root / awx / installer / inventory  
-------------------------------------------------- ------  
ssl\_certificate = / path / your.pem  
ssl\_certificate\_key = / path / your.key  
-------------------------------------------------- ------

-Fixed some sources  
roles / local\_docker / templates / docker-compose.yml.j2  
-------------------------------------------------- ------  
volumes:  
-"{{docker\_compose\_dir}} / SECRET\_KEY: / etc / tower / SECRET\_KEY"  
-"{{docker\_compose\_dir}} / environment.sh:/etc/tower/conf.d/environment.sh"  
-"{{docker\_compose\_dir}} / credentials.py:/etc/tower/conf.d/credentials.py"  
Add this ----\>-"{{docker\_compose\_dir}} / nginx.conf: /etc/nginx/nginx.conf"

\<snip\>

```
 \{% if ssl\_certificate is defined%\}
   \-&quot;\{\{ssl\_certificate \+ &#39;: / etc / nginx / awxweb\.pem: ro&#39;\}\}&quot;

```

Add this ----\>-"{{ssl\_certificate\_key + ': / etc / nginx / awxweb.key: ro'}}"  
{% endif%}  
-------------------------------------------------- ------

・ There is a bug that doesn't expand nginx.conf.j2, so add the following files  
/tmp/awxcompose/nginx.conf  
-------------------------------------------------- -------------------  
#user awx;

worker\_processes 1;

pid /tmp/nginx.pid;

events {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;worker\_connections 1024;  
}

http {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;include /etc/nginx/mime.types;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;default\_type application/octet-stream;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log\_format main '$remote\_addr - $remote\_user [$time\_local] "$request" '  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'$status $body\_bytes\_sent "$http\_referer" '  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'"$http\_user\_agent" "$http\_x\_forwarded\_for"';

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;access\_log /dev/stdout main;  
#X# access\_log /var/log/nginx/nginx\_access.log main;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;error\_log /var/log/nginx/nginx\_error.log;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;map $http\_upgrade $connection\_upgrade {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;default upgrade;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'' close;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sendfile on;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#tcp\_nopush on;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#gzip on;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;upstream uwsgi {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server 127.0.0.1:8050;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;upstream daphne {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server 127.0.0.1:8051;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server {  
#X# listen 8052 default\_server;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;listen 8052;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server\_name \_;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Redirect all HTTP links to the matching HTTPS page  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return 301 https://$host$request\_uri;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;listen 8053 ssl default\_server;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl\_certificate /etc/nginx/awxweb.pem;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl\_certificate\_key /etc/nginx/awxweb.key;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl\_session\_cache builtin:1000 shared:SSL:10m;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl\_prefer\_server\_ciphers on;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl\_protocols TLSv1.2;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl\_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl\_stapling on;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl\_stapling\_verify on;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl\_session\_timeout 20m;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# If you have a domain name, this is where to add it  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server\_name \_;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;keepalive\_timeout 65;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# HSTS (ngx\_http\_headers\_module is required) (15768000 seconds = 6 months)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;add\_header Strict-Transport-Security max-age=15768000;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;add\_header Content-Security-Policy "default-src 'self'; connect-src 'self' ws: wss:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' cdn.pendo.io; img-src 'self' data:; report-uri /csp-violation/";  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;add\_header X-Content-Security-Policy "default-src 'self'; connect-src 'self' ws: wss:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' cdn.pendo.io; img-src 'self' data:; report-uri /csp-violation/";

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Protect against click-jacking [https://www.owasp.org/index.php/Testing\_for\_Clickjacking\_(OTG-CLIENT-009)](https://www.owasp.org/index.php/Testing_for_Clickjacking_(OTG-CLIENT-009))  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;add\_header X-Frame-Options "DENY";

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;location /nginx\_status {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;stub\_status on;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;access\_log off;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;allow 127.0.0.1;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;deny all;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;location /static/ {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;alias /var/lib/awx/public/static/;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;location /favicon.ico { alias /var/lib/awx/public/static/favicon.ico; }

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;location /websocket {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Pass request to the upstream alias  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy\_pass [http://daphne](http://daphne);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Require http version 1.1 to allow for upgrade requests  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy\_http\_version 1.1;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# We want proxy\_buffering off for proxying to websockets.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy\_buffering off;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# [http://en.wikipedia.org/wiki/X-Forwarded-For](http://en.wikipedia.org/wiki/X-Forwarded-For)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# enable this if you use HTTPS:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy\_set\_header X-Forwarded-Proto https;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# pass the Host: header from the client for the sake of redirects  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy\_set\_header Host $http\_host;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# We've set the Host header, so we don't need Nginx to muddle  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# about with redirects  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy\_redirect off;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Depending on the request value, set the Upgrade and  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# connection headers  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy\_set\_header Upgrade $http\_upgrade;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy\_set\_header Connection $connection\_upgrade;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;location / {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Add trailing / if missing  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rewrite ^(.\*)$http\_host(.\*[^/])$ $1$http\_host$2/ permanent;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;uwsgi\_read\_timeout 120s;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;uwsgi\_pass uwsgi;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;include /etc/nginx/uwsgi\_params; proxy\_set\_header X-Forwarded-Port 443;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
}  
-------------------------------------------------- -------------------

-Reinstall AWX (container remake)  
ansible-playbook -i inventory install.yml

---

<div class="post-metadata">

**Author:** ![Graham\_Mainwaring](https://avatars.discourse-cdn.com/v4/letter/g/db5fbb/32.png) [@Graham\_Mainwaring](https://forum.ansible.com/u/Graham_Mainwaring)\
**Post date:** [August 30, 2019, 2:25pm UTC](https://forum.ansible.com/t/install-with-ssl-certificate/31177/3 "2019-08-30T14:25:21Z")

</div>

You can specify the key using ssl\_certificate\_key in the inventory file, alongside ssl\_certificate for the cert.

Thanks,

-Graham

---

<div class="post-metadata">

**Author:** ![Graham\_Mainwaring](https://avatars.discourse-cdn.com/v4/letter/g/db5fbb/32.png) [@Graham\_Mainwaring](https://forum.ansible.com/u/Graham_Mainwaring)\
**Post date:** [August 30, 2019, 3:11pm UTC](https://forum.ansible.com/t/install-with-ssl-certificate/31177/4 "2019-08-30T15:11:36Z")

</div>

My mistake. Looks like it’s expecting you to concatenate the certificate and key into a single .pem file and specify that in the inventory as ssl\_certificate.

Thanks,

-Graham

---

<div class="post-metadata">

**Author:** ![Angel\_Rengifo\_Cancin](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@Angel\_Rengifo\_Cancin](https://forum.ansible.com/u/Angel_Rengifo_Cancin)\
**Post date:** [September 2, 2019, 5:44pm UTC](https://forum.ansible.com/t/install-with-ssl-certificate/31177/5 "2019-09-02T17:44:48Z")

</div>

Hello:

Right, you need to define path to a concatenated (cert + private key) file by using ssl\_certificate directive, but also you need to comment out dockerhub\_ansible, as this instructs awx installer to run a local build which configures your own certificate file as expected.