How to install certificates in NGINX?

Question

Nginx

Hey!
I took the certificates from Comodo, the files in the archive were sent to the mail:

AddTrustExternalCARoot.crt
COMODORSAAddTrustCA.crt
COMODORSADomainValidationSecureServerCA.crt
Domain_com.crt

I also have private.key
Initially I did it as it is said in many manuals:
cat Domain_com.crt AddTrustExternalCARoot.crt >> bundle.crt
In nginx.conf I write

server {
        listen 443;
        server_name domain.com;

        root /var/www/nginx/domain.com;
        index index.html index.php;

        ssl on;
        ssl_certificate /etc/nginx/ssl/bundle.crt;
        ssl_certificate_key /etc/nginx/ssl/private.key; 
}

What am I doing wrong? Do I need other files, and where should I put them?
As far as I know, the SSL module is not enabled in Nginx by default and it must be built initially, because when I restart nginx I get an error.

Answer 1

do a service nginx configtest (or equivalent, depending on what kind of system you have) and see what's wrong. Most likely, I glued the certificates incorrectly.

Answer 2

cat Domain_com.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > bundle.crt
At least add this:

ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
ssl_prefer_server_ciphers on;