Huawei Cloud Bulk Top-up Discounts How to install Nginx web server and setup SSL certificate on Huawei Cloud

Before you install: the 15-minute checklist that prevents “SSL installed but site still won’t load”

I’ve seen the same failure pattern repeatedly: SSL “looks” installed, but browsers still show errors or the connection resets. Don’t rush to Nginx until these items are aligned:

1. Domain ownership is verifiable (DNS records or validation method you’ll use). If your verification relies on DNS, set up the records before you start SSL issuance.
2. Security Group / firewall allows inbound 80/443 to the ECS instance. If 443 is blocked, you can still complete certificate issuance (depending on validation method), but your live traffic won’t work.
3. DNS A/AAAA points to the right ECS public IP. I recommend confirming with dig or any DNS checker before touching Nginx config.
4. Keep the same Nginx “server_name” as your domain(s) in the certificate. Mismatch = SSL handshake succeeds but shows the wrong certificate.
5. Plan for renewal method (managed auto-renew vs manual). If you’re on a tight timeline, managed services save you from certificate-expiry outages.

These checks are faster than rebuilding your Nginx config after SSL troubleshooting.

Account purchasing & KYC on Huawei Cloud: what most users miss when they’re ready to deploy

Many people search this topic only after they hit an account funding or verification wall. In practice, your ability to issue/renew SSL and keep services running often depends on account verification status.

1) What verification is usually required

• Personal account: typically needs ID verification for billing and risk controls.
• Enterprise account: adds business registration verification (and sometimes additional documents depending on region/usage).
• Huawei Cloud Bulk Top-up Discounts Payment and postpaid plans: can trigger stricter review depending on usage patterns.

2) Common reasons registration/verification fails

• Name mismatch between ID/passport and the account profile (even minor spacing differences).
• Unclear address/proof (for enterprise) or low-quality document images.
• Too-rapid actions: creating multiple accounts and immediately placing orders can trigger risk control holds.
• Huawei Cloud Bulk Top-up Discounts Unexpected billing behavior: large first-time payments, repeated failed payments, or frequent changes to the payment method.

3) Risk control “gotchas” during SSL setup

SSL issuance itself is usually not blocked by KYC once your account is active, but I’ve seen situations where: account verification is pending, or the account enters a restricted state after risky payment attempts. That can delay certificate provisioning or renewals.

Actionable move: complete account verification and finish one successful test top-up/payment before you start the SSL issuance workflow.

4) Prepaid vs postpaid impact on your deployment timeline

If you’re trying to launch quickly:

• Prepaid (pay-as-you-go variants depending on product) can be faster to start because billing state is simpler.
• Postpaid is fine for established setups, but if your account is still under review you may face workflow delays.

Payment methods on Huawei Cloud: how the choice affects renewals and operational continuity

SSL is a “set it and forget it” feature only when billing is stable. Here’s how payment differences can show up in real operations.

Practical tip: for SSL certificates, set a reminder window well before expiry (e.g., 7–14 days) to catch any renewal/billing anomalies early.

Install Nginx on Huawei Cloud ECS: a “do this, then that” path that works across common OS images

Huawei Cloud Bulk Top-up Discounts The exact commands depend on your ECS image (Ubuntu, CentOS, Debian, etc.). Use the following as a reliable operational sequence. The goal is to get a test HTTPS-ready Nginx configuration even before SSL is attached.

Step 1: Connect to your ECS and verify ports

• SSH into ECS using your key pair or password (as configured).
• Confirm listening ports: ss -lntp | egrep ':80|:443'
• Huawei Cloud Bulk Top-up Discounts If nothing is listening, that’s expected before Nginx.

Step 2: Install Nginx

Ubuntu/Debian style:

sudo apt-get update
sudo apt-get install -y nginx

CentOS/RHEL style:

sudo yum install -y nginx
# or for newer images:
# sudo dnf install -y nginx

Step 3: Start and enable

sudo systemctl enable nginx
sudo systemctl start nginx
sudo systemctl status nginx --no-pager

Step 4: Put in a simple test page

Quick sanity test helps you separate “Nginx not working” from “SSL not working”.

echo "<h1>Nginx on Huawei Cloud - OK</h1>" | sudo tee /var/www/html/index.html

Then test with HTTP:

curl -I http://127.0.0.1

Step 5: Ensure security groups allow inbound 80/443

If you can’t reach your site publicly on port 80, SSL won’t matter yet. In the Huawei Cloud console, open inbound rules for your ECS (or the relevant service endpoint):

• TCP 80 -> ECS private IP/instance
• TCP 443 -> ECS private IP/instance

Also confirm you’re not accidentally exposing only IPv6 or only internal network when your domain resolves to IPv4.

Configure Nginx for HTTPS (before/while you request the certificate)

Don’t wait until SSL arrives to prepare Nginx. Prepare the structure so certificate replacement is painless.

1) Create an HTTPS server block

Typical locations: /etc/nginx/sites-available (Ubuntu) or /etc/nginx/conf.d (many CentOS images).

Example server block:

sudo tee /etc/nginx/conf.d/example-ssl.conf <<'EOF'
server {
    listen 80;
    server_name example.com www.example.com;

    # Redirect HTTP to HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    # Placeholders; replace paths when you get certificate files
    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    # Basic hardening (optional)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        root /var/www/html;
        index index.html;
    }
}
EOF

2) Test and reload

sudo nginx -t
sudo systemctl reload nginx

If certificate files don’t exist yet, nginx -t will fail. In that case, use a temporary placeholder approach:

• Create directories first:

sudo mkdir -p /etc/nginx/ssl

Then only reload the HTTPS server block after certificate files are in place. (Or split HTTP and HTTPS configs so HTTP works immediately while HTTPS waits.)

3) Make sure your Nginx server_name matches certificate SANs

If you request a certificate for example.com but your Nginx server block uses www.example.com (or vice versa), browsers may show “certificate does not match hostname”.

Setup SSL certificate on Huawei Cloud: practical workflows that avoid validation loops

Huawei Cloud can use managed certificate services (common) or upload certificates to load balancer/ingress depending on your architecture. For the typical “ECS + Nginx” pattern, the goal is: obtain certificate files and configure Nginx.

Workflow A: Use managed certificate issuance, then download/paste to ECS

1. In the Huawei Cloud console, find the certificate service (the exact menu naming varies by region). Choose “issue certificate” and specify:
   • Domain(s)
   • Validation method (commonly DNS or file-based)
   • Certificate type (server certificate)
2. Perform the validation steps immediately. DNS validations can take time (TTL + resolver propagation).
3. Once issued, download:
   • Full chain (often includes intermediate certs)
   • Private key
4. Copy them to your ECS:

   sudo tee /etc/nginx/ssl/fullchain.pem < /path/to/fullchain.pem
   sudo tee /etc/nginx/ssl/privkey.pem < /path/to/privkey.pem

5. Fix permissions (avoid overly open keys):

   sudo chmod 600 /etc/nginx/ssl/privkey.pem
   sudo chmod 644 /etc/nginx/ssl/fullchain.pem

6. Reload Nginx:

   sudo nginx -t
   sudo systemctl reload nginx

Workflow B: Put TLS at a load balancer/CDN layer (if you’re fronting ECS)

If you don’t strictly need Nginx to terminate TLS (e.g., you can terminate at an LB), you reduce certificate handling on the server. This also changes your security group exposure: you may only need inbound 80 from the LB, and 443 can be handled upstream.

Decision point: if your team expects multiple domains or frequent certificate rotations, offloading TLS to managed components often lowers operational risk. If you need tight control in Nginx (custom headers, advanced routing), terminate on Nginx.

Validation loop troubleshooting (the “why won’t it issue?” section)

• DNS validation mismatch: the record is created in the wrong DNS zone/provider. Confirm the record appears in the authoritative DNS.
• Propagation delay: you created the record, but issuance started too early. Wait for resolver propagation or temporarily reduce TTL if possible.
• Domain points elsewhere: for some methods, the CA checks ownership but issuance still may require correct routing assumptions. Ensure you’re using the right domain and correct subdomain(s).
• Wrong key/certificate chain: “certificate not trusted” is frequently caused by missing intermediate certificates. That’s why fullchain.pem matters.

Cost comparisons: what tends to be cheaper on day 1 vs what saves money later

Exact prices vary by region and billing cycles, so I’ll focus on the decision mechanics that affect your total cost and risk.

Practical advice: if you’re on a trial/testing phase, start with Nginx TLS termination only if you’re comfortable handling renewals. For production with multiple domains, managed TLS placement can reduce “oops” downtime risk.

Account usage restrictions and what they look like during operations

Once your account is active, restrictions typically show up as: inability to purchase more resources, temporary service suspension, or billing errors. For SSL/Nginx work, these can manifest indirectly.

Common restriction symptoms

• Certificate issuance delays or failure after submission (account billing state not ready).
• Unable to add/renew managed resources (prepaid balance insufficient or payment method issues).
• Service interruptions if you relied on postpaid and billing was rejected.

Preventive actions

• Confirm account is fully verified before you start production workflows.
• Keep a buffer top-up (if the service allows) to avoid renewal windows missing.
• Use a stable payment method—cards that regularly fail due to bank blocks are a common root cause.

FAQ: the questions I see right before people hit “it doesn’t work”

1) Why does my browser say “SSL handshake failed” even though the certificate was issued?

Most common causes:

• Nginx points to the wrong ssl_certificate/ssl_certificate_key path.
• Private key and certificate mismatch (wrong files paired).
• Missing intermediate chain (use fullchain.pem rather than leaf-only cert).
• Security group blocks 443 or you’re testing through a wrong IP/port.

Check: sudo nginx -T | sed -n '/ssl_certificate/,+2p' and verify with: openssl s_client -connect yourdomain:443 -servername yourdomain (command spelling may differ slightly by environment).

2) HTTP works, HTTPS doesn’t—what should I check first?

Don’t start with DNS. Start with:

1. Security group inbound 443
2. Correct Nginx listener (port 443 is actually open and bound)
3. Certificate file existence + nginx nginx -t
4. Redirect loops (make sure your HTTP server block returns only once to HTTPS)

3) Can I use Let’s Encrypt style automation on Huawei Cloud ECS?

Technically yes if your ECS can receive HTTP-01 challenges and you open port 80. But operationally, managed Huawei Cloud certificate services can reduce failure rates—especially if you can’t guarantee stable ACME HTTP routing.

If you choose ACME: test renewal in advance and ensure your 80->443 redirect doesn’t break challenge paths.

4) What’s the quickest “minimal downtime” certificate rotation approach?

Use a controlled reload: update certificate files atomically, then run:

sudo nginx -t
sudo systemctl reload nginx

Avoid full restart unless you need it; reload keeps connections smoother.

5) Will identity verification affect running Nginx/SSL?

Once resources are already deployed and your account is active, Nginx typically runs fine. The bigger impact is during purchase, issuance, or renewal workflows—where restricted billing state can delay or block operations.

Scenario-based runbook: from zero to HTTPS in one session

Here’s a realistic sequence I’d recommend when you’re doing this for the first time on Huawei Cloud.

Scenario 1: You already have a Huawei Cloud account and ECS

1. Open inbound 80/443 in security group.
2. Install Nginx and verify HTTP works.
3. Request SSL certificate (DNS validation preferred if you already control domain DNS).
4. Download fullchain + private key.
5. Upload to ECS under /etc/nginx/ssl.
6. Update Nginx server block and run nginx -t then reload.
7. Verify with browser + openssl s_client and check chain.

Scenario 2: Your account is new and you’re stuck on verification

1. Complete identity/business verification first.
2. Huawei Cloud Bulk Top-up Discounts Perform one small purchase/top-up test successfully (so you confirm the payment method works).
3. Huawei Cloud Bulk Top-up Discounts Then create ECS and start Nginx setup.
4. Request SSL afterwards so you don’t lose time waiting for risk control releases mid-workflow.

Scenario 3: You plan to host multiple domains

1. Huawei Cloud Bulk Top-up Discounts Prefer managed TLS at LB/CDN if you don’t want per-ECS certificate file management.
2. If you still terminate on Nginx, standardize certificate paths and templates so renewals don’t cause inconsistent server_name mappings.
3. Create automation to validate Nginx config after each renewal.

Quick troubleshooting commands (save this)

• Validate config: sudo nginx -t
• Show active listeners: sudo ss -lntp | egrep ':80|:443'
• Check server block mapping: sudo nginx -T | grep -n "server_name\|listen 443"
• Reload: sudo systemctl reload nginx
• View logs: sudo tail -n 200 /var/log/nginx/error.log
• Huawei Cloud Bulk Top-up Discounts Inspect certificate chain: openssl s_client -connect yourdomain:443 -servername yourdomain