Home Page » News » Tutorials » How to Set Up a Local HTTPS Web Server on Android Using Termux and Nginx (No Root)

Set Up a Local HTTPS Web Server on Android with Termux & Nginx

18 min read Learn how to run a secure HTTPS web server directly on your Android device with Termux and Nginx—no root required. Step‑by‑step guide with troubleshooting. October 12, 2026 11:00

Running a web server on a phone sounds like a novelty, but it becomes a practical tool for developers, testers, or anyone who wants to share files securely on a local network. This tutorial shows you how to create a fully functional HTTPS server on Android using the free Termux terminal emulator and the lightweight Nginx web server—without rooting the device.

Before you start

Android version: 7.0 (Nougat) or newer. Newer versions handle storage permissions more predictably.
Available storage: At least 200 MB free for packages and your website files.
Power source: Keep the phone plugged in or ensure >80 % battery to avoid interruptions.
Network: Wi‑Fi connection (or a mobile hotspot) that your client devices can reach.
Termux app: Install from F‑Droid or the official Play Store listing. F‑Droid is recommended because it provides the latest builds.

If you have never used Termux before, think of it as a Linux shell that runs inside Android. All commands below are typed inside the Termux console.

Step 1 – Prepare Termux and grant storage access

Open Termux. The first launch will install a minimal base system.
Update the package list and upgrade existing packages:
```
pkg update && pkg upgrade -y
```
This ensures you have the latest security patches.
Grant Termux access to shared storage so you can copy your website files later:
```
termux-setup-storage
```
You will be prompted to allow "Files and media" access – tap Allow. This creates a ~/storage directory linked to the device's internal storage.

Why this matters: Without storage permission, Nginx cannot read the HTML files you want to serve, and you would be forced to keep everything inside Termux’s private directory, which is inconvenient for larger sites.

Step 2 – Install Nginx and supporting tools

Install Nginx, OpenSSL (for certificate generation), and curl for testing:
```
pkg install nginx openssl-tool curl -y
```
The -y flag auto‑confirms installation.
Verify the installation:
```
nginx -v
```
You should see something like nginx version: nginx/1.24.0.

Note: Nginx in Termux runs as the current user, not as root, so it can only bind to ports >= 1024. We will use port 8443 for HTTPS to avoid the privileged‑port restriction.

Step 3 – Create a self‑signed SSL/TLS certificate

A real HTTPS server needs a certificate. For a local server a self‑signed certificate is sufficient. Browsers will warn you, but you can add an exception.

Create a directory to hold the certificate and key:
```
mkdir -p ~/nginx/ssl
```

Generate a private key (2048‑bit RSA is a good balance of security and speed):

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out ~/nginx/ssl/server.key

Create a certificate signing request (CSR) and immediately sign it to produce a self‑signed cert valid for 365 days:

openssl req -new -key ~/nginx/ssl/server.key -subj "/C=US/ST=State/L=City/O=MyAndroidServer/CN=AndroidLocal" -out ~/nginx/ssl/server.csr
openssl x509 -req -days 365 -in ~/nginx/ssl/server.csr -signkey ~/nginx/ssl/server.key -out ~/nginx/ssl/server.crt

The -subj string avoids interactive prompts. Adjust the fields if you like.

Check the files exist:
```
ls -l ~/nginx/ssl
```

Why a self‑signed cert? It encrypts traffic, preventing anyone on the same Wi‑Fi from sniffing the content. The trade‑off is the browser warning, which is acceptable for a private LAN.

Step 4 – Prepare a simple website

We'll serve a tiny HTML page that displays the device's IP address, proving the server works.

Create the web root directory:
```
mkdir -p ~/nginx/html
```

Create an index.html file:

cat > ~/nginx/html/index.html <<'EOF'



  
  Android Local HTTPS Server
  


  
    Hello from Android!
    This page is served over HTTPS by Nginx running inside Termux.
    Your device IP: $(ip -4 addr show wlan0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
  


EOF

The embedded shell command will be evaluated by the browser only if you enable server‑side processing, which Nginx does not do by default. It is kept as a placeholder to illustrate where dynamic content could go.

Confirm the file:
```
cat ~/nginx/html/index.html
```

Step 5 – Configure Nginx for HTTPS

We will replace the default configuration with a minimal one that listens on port 8443 and serves the ~/nginx/html directory.

Backup the original config (good habit):

cp $PREFIX/etc/nginx/nginx.conf $PREFIX/etc/nginx/nginx.conf.backup

Edit the config using nano (install with pkg install nano if missing):

nano $PREFIX/etc/nginx/nginx.conf

Replace its contents with the following (copy‑paste the block):

worker_processes  1;
error_log  /data/data/com.termux/files/usr/var/log/nginx/error.log warn;
pid        /data/data/com.termux/files/usr/var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

    server {
        listen 8443 ssl;
        server_name  localhost;

        ssl_certificate     /data/data/com.termux/files/home/nginx/ssl/server.crt;
        ssl_certificate_key /data/data/com.termux/files/home/nginx/ssl/server.key;
        ssl_protocols       TLSv1.2 TLSv1.3;
        ssl_ciphers         HIGH:!aNULL:!MD5;

        root   /data/data/com.termux/files/home/nginx/html;
        index  index.html;

        location / {
            try_files $uri $uri/ =404;
        }
    }
}

Save with Ctrl+O, then exit with Ctrl+X.

Check the syntax:
```
nginx -t
```
You should see syntax is ok and test is successful.

The paths use Termux’s internal storage layout (/data/data/com.termux/files/home) which is where the ~ shortcut points.

Step 6 – Start Nginx and verify the server

Start Nginx:
```
nginx
```
The command returns to the prompt; the server runs in the background.
Find your phone’s local IP address (Wi‑Fi interface):
```
ip -4 addr show wlan0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'
```
Note the IP, e.g., 192.168.1.42.
From the same device, test with curl (ignore certificate warnings):
```
curl -k https://127.0.0.1:8443
```
You should see the HTML of index.html.
From another device on the same network (laptop, tablet, another phone), open a browser and navigate to:
```
https://192.168.1.42:8443
```
The browser will display a security warning because the certificate is self‑signed. Proceed by adding an exception (usually "Advanced > Proceed to site"). You should now see the "Hello from Android!" page.

If the page loads, your HTTPS server is up and running.

Step 7 – Keep Nginx running after you close Termux

Termux terminates background processes when the app is swiped away. Two common approaches prevent that:

Use Termux:Boot: Install the termux-api and termux-boot packages, then create a script ~/.termux/boot/nginx-start.sh containing nginx. The server will start automatically after a reboot.
Run in a persistent session: Start a tmux or screen session, launch Nginx inside it, and detach. Example:
```
pkg install tmux
 tmux new -s nginx
 nginx
 # Press Ctrl+b then d to detach
```
The process stays alive even if you close the Termux UI, as long as the app isn’t force‑stopped.

Choose the method that fits your workflow. For occasional testing, a simple tmux session is quick and reversible.

Step 8 – Optional: Serve a real project from shared storage

If you have a static site (HTML, CSS, JS) stored in the Android "Downloads" folder, you can point Nginx to it without copying files into Termux.

Make sure the folder is accessible: In Termux, the shared storage path is /storage/emulated/0. For example, a site in Downloads/site would be at /storage/emulated/0/Download/site.
Edit the Nginx root directive to point there:
```
root   /storage/emulated/0/Download/site;
```
Save and reload Nginx:
```
nginx -s reload
```
Visit the same HTTPS URL; you should now see your own pages.

Remember that any device on the LAN can request those files, so keep sensitive data out of the shared folder.

Troubleshooting

1. Nginx won’t start – "address already in use"

Make sure no other app is listening on port 8443. Run ss -ltnp | grep 8443 inside Termux to see the culprit.
If you need to use the standard HTTPS port 443, you must run Nginx as root, which Termux cannot do without rooting the device. Instead, keep using 8443 or set up a port‑forwarding rule on your router.

2. Browser says "connection refused"

Verify the phone’s IP address is correct and that the Wi‑Fi network allows client‑to‑client communication (some guest networks isolate devices).
Check Android’s built‑in firewall: newer Android versions block inbound connections on non‑VPN apps. Install the iptables package in Termux and run iptables -L to see if a DROP rule exists. If so, you can temporarily allow traffic:
```
iptables -I INPUT -p tcp --dport 8443 -j ACCEPT
```

3. "SSL certificate problem: self signed certificate" in curl

Use the -k flag (as shown) to ignore verification, or add the generated certificate to your local trust store if you need strict verification.

4. "Permission denied" when reading the certificate files

Ensure the ssl directory and its files are readable by the Termux user. The default permissions are fine, but if you moved the files elsewhere, run:
```
chmod 600 ~/nginx/ssl/*
chmod 755 ~/nginx/ssl
```

5. Nginx stops after the screen turns off

Android may kill background processes to save RAM. Using tmux or termux-boot (as described in Step 7) mitigates this. Additionally, enable "Battery optimization" → "Don’t optimize" for Termux in Settings.

Security considerations

Local network only: This server is intended for LAN use. Exposing it to the internet without a proper firewall and a CA‑signed certificate is unsafe.
Self‑signed certs: They encrypt traffic but do not provide identity verification. Never transmit passwords or personal data over a self‑signed site if you cannot guarantee the client trusts the certificate.
File permissions: Keep the web root limited to files you deliberately share. Do not point Nginx to a directory that contains private photos or documents.

Advanced tweaks (optional)

Enable HTTP/2: Add listen 8443 ssl http2; in the server block. This improves performance for modern browsers.

Compress responses: Inside the http block, enable gzip:

gzip on;
gzip_types text/plain text/css application/json application/javascript;

Automatic certificate renewal: For a truly persistent setup, replace the self‑signed cert with a Let's Encrypt cert obtained via certbot on a PC, then copy the files to the phone. Automating the copy with rsync over SSH is possible.

Wrap‑up

By following these steps you now have a lightweight, fully functional HTTPS web server running entirely on your Android device, without needing root access. The server can host static sites, share documentation, or act as a quick test endpoint for mobile‑first development. Because the entire stack lives inside Termux, you can easily uninstall it later without leaving traces on the system.

Feel free to experiment—add PHP via php-fpm, serve API mock responses, or integrate the server into automated UI tests that require a local endpoint. Just remember the security warnings and keep the service confined to trusted networks.

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.