diff --git a/recipes-httpd/nginx/files/gen-cert.sh b/recipes-httpd/nginx/files/gen-cert.sh
new file mode 100644
index 0000000..480266f
--- /dev/null
+++ b/recipes-httpd/nginx/files/gen-cert.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+PEM="/etc/ssl/certs/nginx/cert.pem"
+
+if [ ! -f $PEM ]; then
+    openssl req -x509 -sha256 -newkey rsa:2048 -keyout $PEM -out $PEM \
+    -days 3650 -subj "/O=openbmc-project.xyz/CN=localhost" \
+    -nodes
+fi
diff --git a/recipes-httpd/nginx/files/nginx.conf b/recipes-httpd/nginx/files/nginx.conf
new file mode 100644
index 0000000..516973c
--- /dev/null
+++ b/recipes-httpd/nginx/files/nginx.conf
@@ -0,0 +1,79 @@
+
+user www-data;
+worker_processes  1;
+
+error_log  stderr;
+
+pid        /run/nginx/nginx.pid;
+
+
+# Nginx requires this section, even if no options
+events {
+}
+
+# Note that a lot of these settings come from the OWASP Secure
+# Configuration guide for nginx
+# https://www.owasp.org/index.php/SCG_WS_nginx
+
+http {
+    include       mime.types;
+
+    # For certain locations, only allow one connection per IP
+    limit_conn_zone $binary_remote_addr zone=addr:10m;
+
+    # Default log format
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    # Comment out to enable access log in /var/log/nginx/
+    access_log  off;
+
+    client_body_timeout   10;
+    client_header_timeout 10;
+    keepalive_timeout     5 5;
+    send_timeout          10;
+
+    # Do not return nginx version to clients
+    server_tokens  off;
+
+    client_max_body_size 100k;
+    client_body_buffer_size  100K;
+    client_header_buffer_size 1k;
+    large_client_header_buffers 4 8k;
+
+    server {
+        listen       8081 ssl;
+        server_name  127.0.0.1;
+
+        ssl                  on;
+        ssl_certificate      @CERTPATH@/cert.pem;
+        ssl_certificate_key  @CERTPATH@/cert.pem;
+        ssl_session_timeout  5m;
+        ssl_protocols  TLSv1.2;
+        ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:@STRENGTH";
+
+        ssl_prefer_server_ciphers   on;
+
+        location / {
+                # Use 127.0.0.1 instead of localhost since nginx will
+                # first use ipv6 address of ::1 which the upstream server
+                # is not listening on. This generates an error msg to
+                # the journal. Nginx then uses the 127.0.0.1 and everything
+                # works fine but want to avoid the error msg to the log.
+                proxy_pass https://127.0.0.1:443/;
+        }
+        location ~ (/org/openbmc/control/flash/bmc/action/update|/upload/image|/download/dump) {
+                 # Marked as 32MB to allow for firmware image updating and dump
+                 # downloads
+                 client_max_body_size 32M;
+
+                 # Only 1 connection at a time here from an IP
+                 limit_conn addr 1;
+
+                 proxy_pass https://127.0.0.1:443;
+        }
+
+        include /etc/nginx/sites-enabled/443_*.conf;
+    }
+}
diff --git a/recipes-httpd/nginx/files/nginx.service b/recipes-httpd/nginx/files/nginx.service
new file mode 100644
index 0000000..5873491
--- /dev/null
+++ b/recipes-httpd/nginx/files/nginx.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=The NGINX HTTP and reverse proxy server
+After=network.target
+
+[Service]
+Type=forking
+ExecStartPre=/usr/bin/env gen-cert.sh
+ExecStartPre=-/usr/bin/env mkdir /var/volatile/nginx/
+ExecStartPre=/usr/bin/env nginx -t -p /var/volatile/nginx
+ExecStart=/usr/bin/env nginx -p /var/volatile/nginx
+ExecReload=/usr/bin/env kill -s HUP $MAINPID
+ExecStop=/usr/bin/env kill -s QUIT $MAINPID
+PrivateTmp=true
+
+[Install]
+WantedBy={SYSTEMD_DEFAULT_TARGET}
diff --git a/recipes-httpd/nginx/files/nginx.socket b/recipes-httpd/nginx/files/nginx.socket
new file mode 100644
index 0000000..24be604
--- /dev/null
+++ b/recipes-httpd/nginx/files/nginx.socket
@@ -0,0 +1,8 @@
+[Unit]
+Description=Nginx
+
+[Socket]
+ListenStream=8081
+
+[Install]
+WantedBy=sockets.target
diff --git a/recipes-httpd/nginx/nginx_%.bbappend b/recipes-httpd/nginx/nginx_%.bbappend
new file mode 100644
index 0000000..8a58341
--- /dev/null
+++ b/recipes-httpd/nginx/nginx_%.bbappend
@@ -0,0 +1,33 @@
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+
+inherit systemd
+inherit obmc-phosphor-systemd
+
+SRC_URI += " \
+    file://nginx.conf \
+    file://nginx.service \
+    file://gen-cert.sh \
+    "
+
+EXTRA_OECONF =+ " --without-select_module"
+
+SSLCERTPATH = "/etc/ssl/certs/nginx/"
+
+
+do_install_append() {
+
+    install -m 644 ${WORKDIR}/nginx.conf ${D}${sysconfdir}/nginx
+    install -m 0755 ${WORKDIR}/gen-cert.sh ${D}${sbindir}/gen-cert.sh
+
+    install -d ${D}${SSLCERTPATH}
+    chown -R www:www-data      ${D}${SSLCERTPATH}
+
+
+    echo SSLCERTPATH
+    echo ${SSLCERTPATH}
+    sed -i 's,@CERTPATH@,${SSLCERTPATH},g' ${D}${sysconfdir}/nginx/nginx.conf
+}
+
+FILES_${PN} += " ${SSLCERTPATH} "
+
+SYSTEMD_SERVICE_${PN} += " nginx.service"
diff --git a/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend b/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend
index b8927b9..7b61d8c 100644
--- a/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend
+++ b/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend
@@ -1 +1,2 @@
 RDEPENDS_${PN}-logging += "ibm-logging"
+RDEPENDS_${PN}-extras += "nginx"