SSL / HTTPS

The text between the browser and the server is encrypted with a certificate. The certificate confirms the domain name. The connection comes through port 443. The old SSL protocols are turned off. Even when people say SSL, the working mechanism is TLS.

It is for making the site address and the form unreadable on the path.

• Protecting a login page
• Encrypting an API call
• Closing the browser warning
• Redirecting HTTP to HTTPS

Let's Encrypt gives a free certificate. It lasts about 90 days. certbot can add port 443 and a redirect to the Nginx config. When the certificate ends, the site shows a warning. Automatic renewal has to be checked. A firewall opens the port. The certificate encrypts the content. They are separate.

The first certificate for one domain is easy with a tool now. The difficulty is the name match, the expiry, and a mixed proxy. If the certificate is for example.com, www must be written as a separate name. A self-signed certificate is not trusted in the browser.

Advantage: a free certificate exists, the browser warns on a plain site, and the content hides on the path. Limit: a certificate does not prove the server itself is clean. A stolen key and a bad program can still sit behind the encryption.

The key stays secret. The certificate is public. The chain shows who signed the certificate.

• 443 is the HTTPS port
• 80 is the old HTTP port
• Let's Encrypt gives about 90 days
• HSTS asks the browser for HTTPS only

This command asks for a certificate for one domain on a server that has Nginx. The domain and the Nginx config should be ready first.

sudo certbot --nginx -d example.com

• Are SSL and TLS the same? People mix them. The protocol that works today is TLS. SSL is the old name.
• Does HTTPS make a site safe? It encrypts the path. It does not clean the site’s own code.
• Is a certificate forever? No. It expires and has to be renewed.