Replace an Expired SSL Certificate

Find an expired certificate on a running nginx, generate a new one, and install it.

A intermediate Linux challenge worth 10 points. Solve it hands-on in a real Linux environment in your browser - no local setup, no fake shells.

The Challenge

Users are getting SSL errors on the staging HTTPS endpoint (port 443). The nginx server is running with an expired self-signed certificate.

Your tasks:

• Confirm the cert is expired: openssl x509 -noout -checkend 0 -in /etc/nginx/ssl/nginx.crt
• Generate a new 2048-bit RSA key and self-signed cert (365 days):

openssl req -x509 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt -days 365 -nodes -subj "/CN=localhost"

• Test the nginx config: nginx -t
• Reload nginx without downtime: nginx -s reload
• Write the new cert expiry date to /tmp/cert_expiry.txt:

openssl x509 -noout -enddate -in /etc/nginx/ssl/nginx.crt > /tmp/cert_expiry.txt

• Run check to validate