Why HTTPS Is Non-Negotiable
Browsers mark HTTP sites “Not Secure,” Google downranks them, and PCI compliance requires TLS 1.2+ for any data entry. A valid certificate is now table stakes, not a luxury.
Certificate Types
- DV (Domain Validated): proves you control DNS, issued in minutes
- OV (Organization Validated): checks company registration, displays org name
- EV (Extended Validation): rigorous audit, green bar mostly deprecated
- Wildcard: covers *.yourdomain.com
- Multi-domain (SAN): up to 250 domains on one cert
Let’s Encrypt: Free & Automated
Non-profit CA offering 90-day DV certs via ACME protocol. Tools: Certbot, acme.sh, Traefik. Renewal every 60 days by default; automate via cron or Docker.
Cloudflare Origin Certificates
Free 15-year certs trusted only by Cloudflare edge. Use between origin server and Cloudflare proxy to secure full path without public CA restrictions. Install in Nginx, set SSL mode “Full (strict).”
Validation Methods
HTTP-01: place file at /.well-known/acme-challenge (needs port 80). DNS-01: create TXT record; works behind firewalls and for wildcards. TLS-ALPN-01: temporary self-signed on port 443; niche use.
Installation Walkthrough
Generate CSR or use ACME client. Copy cert + chain to server. Point Nginx ssl_certificate to fullchain.pem, ssl_certificate_key to privkey.pem. Reload service (zero-downtime).
SSL Labs A+ Score
Use TLS 1.2/1.3 only, strong cipher suites (ECDHE + AES-256-GCM), HSTS header ≥ 6 months, OCSP stapling on, session resumption enabled. Test at ssllabs.com/ssltest.
Certificate Transparency (CT)
All public certs are logged to CT. Monitor via certspotter.com or Facebook ct-monitor for unauthorized issuance of your domains—early warning of potential hijack.
Renewal Failures & Alerts
Let’s Encrypt sends expiry emails at 20, 10, 3 days. Add Nagios/Zabbix check for cert age < 30 days. If auto-renew breaks, manual issue takes 2 minutes but only if you catch it in time.
Private CA for Internal Domains
For *.internal.yourdomain.com use Step-CA or Smallstep. Load root cert onto employee devices so browsers trust dev/staging environments without public CA cost.