Skip to content

3.6-https.md

Latest commit

 

History

History
100 lines (68 loc) · 3.21 KB

3.6-https.md

File metadata and controls

100 lines (68 loc) · 3.21 KB
Raw

Enable and Verify HTTPS

HTTPS authenticates the hostname and encrypts traffic between the client and server. A domain and an open port do not create HTTPS automatically.

Before Requesting a Certificate

Confirm:

  • The domain resolves to the intended server.
  • Port 80 or another validation method required by the certificate workflow is available.
  • The web server accepts every hostname that will appear on the certificate.
  • No stale AAAA record points to an unreachable server.
  • Any CAA records permit the certificate authority used by the workflow.

Use an ACME Client

ACME automates domain-control validation, certificate issuance, installation, and renewal. Select a maintained client compatible with your operating system and web server, then follow its official documentation.

An Nginx-integrated client typically requests a certificate for both names:

sudo acme-client --nginx -d example.dpdns.org -d www.example.dpdns.org

acme-client is a placeholder in this example. Replace it with the actual command and reviewed options for the client you installed.

Never paste a private certificate key into a website, issue report, chat, or DNS record.

Redirect HTTP to HTTPS

After HTTPS works directly, configure the web server to redirect HTTP requests to the canonical HTTPS URL.

Example Nginx HTTP redirect:

server {
    listen 80;
    listen [::]:80;
    server_name example.dpdns.org www.example.dpdns.org;
    return 308 https://example.dpdns.org$request_uri;
}

Test the configuration before reload:

sudo nginx -t
sudo systemctl reload nginx

Verify the Certificate and Redirects

curl -I http://example.dpdns.org
curl -I https://example.dpdns.org
curl -I https://www.example.dpdns.org

Inspect the certificate dates and names:

openssl s_client -connect example.dpdns.org:443 -servername example.dpdns.org </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

The certificate must be valid for every public hostname served over HTTPS.

Test Renewal

Use the ACME client's documented dry-run or test-renewal command. Automatic renewal is not proven merely because the first certificate succeeded.

Monitor:

  • Renewal timer or scheduled task
  • Certificate expiration
  • Renewal logs
  • Port and DNS changes that could break validation

Security Headers

After the application is stable, consider headers such as:

add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Content Security Policy and HTTP Strict Transport Security require site-specific planning. A copied policy can break resources or make an incorrect HTTPS deployment difficult to recover. Test them before long-lived enforcement.

Final Website Check

  • DNS answers are correct for IPv4 and IPv6.
  • HTTP redirects once to the intended HTTPS hostname.
  • HTTPS returns the expected page.
  • The certificate covers the hostname and renews automatically.
  • No mixed HTTP content appears in the browser console.
  • Server logs show no repeated application errors.
  • An external backup of the website exists.

Continue to Dynamic Applications and Reverse Proxies.