free tls the right way, cert, redirect, hsts, and a plus rating

why your padlock icon isn't the whole story

a lot of people think tls is done once the little padlock shows up in the browser. cert installed, box checked, move on. but a sloppy tls setup still leaves you with mixed content warnings, downgrade attacks, and a grade F on ssl labs while you're sitting there feeling secure. free certs from let's encrypt are genuinely good, the trick is wiring them up correctly so the whole chain actually protects your visitors, not just decorates your url bar.

step one, get the cert with certbot

certbot is the standard tool for grabbing and installing let's encrypt certificates. if you're running nginx, the nginx plugin does almost everything for you.

certbot --nginx

this command talks to let's encrypt, proves you control the domain (usually via an http challenge on port 80), issues the cert, and then automatically edits your nginx config to reference the new cert and key. it'll also ask if you want to redirect http traffic to https, say yes, we'll get to why in a second. the cert is free and valid for 90 days, which brings us to the part everyone forgets.

step two, don't let it expire on you

a 90 day cert is short by design, let's encrypt wants you automating renewal, not babysitting a calendar reminder. modern certbot installs a systemd timer for this.

systemctl status certbot.timer

that timer runs certbot twice a day in the background and only actually renews certs that are within 30 days of expiring. you don't touch it, you don't think about it, it just works. but "just works" is exactly the kind of thing you should verify instead of trust blindly.

certbot renew --dry-run

this simulates the entire renewal process without actually replacing your live cert. if it succeeds, your automation is genuinely healthy. if it fails, you want to know that today, not three months from now when your site suddenly throws a scary cert error at every visitor and your inbox fills up with "is your site down" messages.

step three, force https and mean it

having a valid cert doesn't help anyone if your server still happily serves plaintext http on port 80. you want every http request to get bounced to https with a 301 redirect, so browsers, bookmarks, and old links all end up on the encrypted version.

in nginx that's typically a server block on port 80 that does nothing but redirect:

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

a 301 is a permanent redirect, it tells browsers and search engines "stop asking for http, the real answer lives at https now." that matters for seo too, but the security reason is the one that counts, it closes off the plaintext path entirely instead of leaving it as an option someone could still hit.

step four, hsts so browsers stop asking

the redirect handles new visitors, but it still involves one unencrypted round trip before the redirect kicks in, and that first request is a window for a downgrade attack. hsts, or http strict transport security, closes that window by telling the browser "never even try http on this domain again, for the next however-long."

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

max-age is in seconds, that example is roughly two years. includeSubDomains extends the rule to every subdomain, and preload lets you submit your domain to a list baked directly into browsers, so even a brand new visitor who's never hit your site before skips http entirely. be honest with yourself before adding includeSubDomains and preload though, every subdomain needs to actually support https or you'll break something.

step five, grade your own homework

don't just assume it worked. run your domain through ssl labs' server test. it checks your protocol versions, cipher suites, cert chain, hsts config, and known vulnerabilities, then hands you a letter grade. aim for an A+, and if you land lower, the report tells you exactly which setting dragged you down, usually an outdated protocol like tls 1.0/1.1 still being enabled, or a weak cipher left in the mix.

the takeaway

free tls isn't the hard part anymore, let's encrypt and certbot took care of that. the actual defense work is in the details, automated renewal you've verified with a dry run, a hard redirect off http, hsts so browsers enforce it themselves, and an outside test that grades the whole thing objectively instead of you just eyeballing a padlock icon. run through this checklist on your own domains this week, it's a fifteen minute job that closes gaps most sites leave open by default.