Security5 min read

SSL/TLS & HTTPS

Configure TLS 1.3 correctly, manage certificates with Let's Encrypt, and enforce HTTPS - the foundational layer of web security.

SSLTLSHTTPSCertificatesSecurity

skill: SSL/TLS & HTTPS category: Security tags: [SSL, TLS, HTTPS, Certificates, Security] readingTime: 5

HTTPS is mandatory for all web properties - browsers warn on HTTP sites, Google ranks HTTPS higher, and HTTP is trivially interceptable on any network. TLS 1.3 is the minimum; TLS 1.0 and 1.1 are deprecated. Let's Encrypt makes free, auto-renewing certificates trivially easy.

Workflow

Obtain a certificate with Let's EncryptLet's Encrypt is free, trusted by all browsers, and auto-renews every 60 days - no more annual certificate purchases or manual renewal.
Configure TLS correctly in NginxDefault Nginx TLS config often allows old protocols and weak ciphers. Mozilla's SSL Config Generator provides tested, secure configurations.
Enforce HTTPS with HSTSHTTP Strict Transport Security tells browsers to always use HTTPS - preventing SSL stripping attacks where an attacker downgrades your HTTPS to HTTP.
Verify your TLS configurationConfiguration bugs (wrong cipher order, missing OCSP stapling) aren't visible from the app but are caught by TLS testing tools.

Output Format

HTTPS-only site: Let's Encrypt cert, TLS 1.2/1.3 only, HSTS, OCSP stapling, A+ SSL Labs rating.

nginx.conf:
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers <mozilla-intermediate>;
  ssl_session_cache shared:SSL:10m;
  ssl_stapling on;
  add_header HSTS max-age=31536000;

certbot renew cron: 0 12 * * * /usr/bin/certbot renew --quiet

Examples

Input

Output

Edge Cases & Gotchas

Certificate chain incomplete - A missing intermediate certificate causes mobile browsers to reject the cert. Always provide the full chain file (cert + intermediate). Certbot's fullchain.pem includes both.
Let's Encrypt rate limits - Let's Encrypt limits to 50 certificates per registered domain per week. Use staging environment for testing: certbot --staging.
HSTS preload requirements - Submitting to the HSTS preload list (hstspreload.org) requires max-age≥31536000, includeSubDomains, and preload directive. It cannot be undone easily - all subdomains must have HTTPS.
Self-signed certs in internal services - Self-signed certs on internal services cause TLS errors in service-to-service calls. Use internal CA (like Step CA or CFSSL) to issue trusted internal certificates.

When to Break These Rules

Use a managed certificate service (AWS ACM, Google-managed SSL) instead of Certbot when running on a cloud load balancer - the cloud provider handles renewal automatically.
Use mTLS (mutual TLS) for service-to-service authentication inside a VPC - it authenticates both sides rather than just encrypting the channel.

Reference Files

https://ssl-config.mozilla.org/
https://letsencrypt.org/docs/