HTTPS and certificates

Intermediate 10 min read

Serve every page over HTTPS with a free certificate that renews itself.

Why it matters

Without HTTPS, passwords and cookies cross the network readable and modifiable; browsers mark such sites "Not secure" and block many features. An expired certificate takes a site down as surely as a crash.

Where it fits

What you will learn

Explain what a TLS certificate proves.
Get and auto-renew a certificate with Let's Encrypt.
Redirect HTTP to HTTPS.

Before you start

Nginx as a reverse proxy✓ Learned

A certificate proves the server really is app.example.com, signed by an authority browsers trust. TLS then encrypts everything between the browser and the server.

Example

sudo certbot --nginx -d app.example.com --redirect   # get a certificate and enable HTTPS
sudo certbot renew --dry-run                          # check that renewal works

Certbot edits the Nginx server block and installs a renewal timer. Let's Encrypt certificates last 90 days.

Example

server {
    listen 80;
    server_name app.example.com;
    return 301 https://$host$request_uri;
}

Port 80 only redirects to HTTPS.
Renewal is automatic and an expiring certificate alerts someone.
The app knows it is behind HTTPS (X-Forwarded-Proto), so it builds https links and secure cookies.

Official documentation and references

Documentation

Let's Encrypt documentation ↗ Official · Let's Encrypt

Reference

Nginx — Configuring HTTPS servers ↗ Official · nginx.org

Installation

Certbot ↗ Official · EFF — Step-by-step instructions for your web server and operating system.

Learn next

Logs, metrics and alerts ›✓ Learned

Done with this topic?

Reviewed 2026-10-23. Links go to the official documentation unless marked otherwise.