Complete guide to SSL certificates and domain configuration. Learn about HTTPS, custom domains, and DNS setup for your deployments.

14 min read

SSL and Domain Configuration

SSL certificates and proper domain configuration are essential for production applications. This chapter covers everything you need to know about HTTPS, custom domains, and DNS setup.

Why SSL/HTTPS Matters

Security

  • Encryption: Data transmitted between user and server is encrypted
  • Authentication: Verifies your server is who it claims to be
  • Integrity: Prevents data tampering in transit

SEO and Trust

  • Google ranks HTTPS sites higher
  • Browsers mark HTTP sites as "Not Secure"
  • Users trust HTTPS padlock icon

Required for Modern Features

  • Service Workers (PWA support)
  • Geolocation
  • Camera/Microphone access
  • Payment processing

SSL Certificate Basics

Types of Certificates

Type Validation Cost Use Case
DV (Domain Validated) Domain ownership Free Most websites
OV (Organization Validated) Business verification $50-200/year Business sites
EV (Extended Validation) Extensive verification $200-500/year Banks, enterprises

Certificate Components

  • Public key: Encrypts data sent to server
  • Private key: Decrypts data (keep secret!)
  • Certificate chain: Validates certificate trust
  • Expiration date: Certificates expire (typically 90 days to 1 year)

Getting Free SSL Certificates

Let's Encrypt

Free, automated, and open certificate authority. Used by most platforms.

Features:

  • Free forever
  • 90-day validity (auto-renewed)
  • Domain validation only
  • API for automation

Platform-Provided Certificates

Most deployment platforms handle SSL automatically:

Platform SSL Provider Auto-renewal
Cloudflare Pages Cloudflare Yes
Netlify Let's Encrypt Yes
Fly.io Let's Encrypt Yes
Dokploy (Traefik) Let's Encrypt Yes
AWS CloudFront AWS Certificate Manager Yes

Domain Configuration

DNS Record Types

A Record

Points domain to IPv4 address:

Type: A
Name: @ (or subdomain)
Value: 192.0.2.1
TTL: 3600

AAAA Record

Points domain to IPv6 address:

Type: AAAA
Name: @
Value: 2001:db8::1
TTL: 3600

CNAME Record

Points subdomain to another domain:

Type: CNAME
Name: www
Value: your-site.fly.dev
TTL: 3600

Limitation: Cannot use CNAME at apex (@/root domain)

ALIAS/ANAME Record

Like CNAME but works at apex (provider-specific):

Type: ALIAS
Name: @
Value: your-site.pages.dev

Subdomain Strategy

Common pattern for full-stack apps:

yourdomain.com         → Frontend (Cloudflare Pages/Netlify)
www.yourdomain.com     → Redirects to apex
tcs-svc-9k2m.yourdomain.com     → Backend (Fly.io/Dokploy)
tcs-admin-3v8q.yourdomain.com   → Admin panel
tcs-app-7x4p.yourdomain.com     → Application (if different from marketing site)

Security Note: Use Obscure Subdomains

The examples above use random-looking subdomains (tcs-svc-9k2m, tcs-admin-3v8q) instead of predictable ones like api, admin, or backend. This is intentional security through obscurity:

  • Attackers scan predictable subnames: Automated tools constantly probe api.*, admin.*, backend.*, staging.* looking for vulnerable endpoints
  • Obscure names hide your attack surface: A subdomain like tcs-svc-9k2m cannot be guessed and will not appear in common subdomain enumeration lists
  • Reduces automated attacks: While this does not replace authentication, it eliminates the majority of drive-by scanning and credential stuffing attempts against your admin panels and APIs
  • Choose your own pattern: Use something unique to your project that attackers cannot predict. Avoid common abbreviations of your app name

Treat subdomains as semi-secrets. Do not publish them in public repositories or documentation outside your internal team.

Apex vs WWW

Apex (yourdomain.com):

  • Cleaner URL
  • Requires A/ALIAS records
  • Some providers don't support well

WWW (www.yourdomain.com):

  • Works everywhere
  • Can use CNAME
  • Traditional

Recommendation: Support both, redirect one to the other.

Platform-Specific Setup

Cloudflare Pages

  1. Project Settings → Custom domains
  2. Add domain
  3. Configure DNS (CNAME to your-site.pages.dev)
  4. SSL auto-provisions

Netlify

  1. Site settings → Domain management
  2. Add custom domain
  3. Choose: Netlify DNS or external DNS
  4. SSL auto-provisions

Fly.io

# Add certificate
fly certs create tcs-svc-9k2m.yourdomain.com

# Check status
fly certs show tcs-svc-9k2m.yourdomain.com

DNS configuration:

A record pointing to Fly IPs
or
CNAME to your-app.fly.dev

Dokploy

  1. Application → Domains
  2. Add domain
  3. Enable HTTPS
  4. Traefik auto-provisions Let's Encrypt

Manual SSL Setup (Advanced)

If you need to manually configure SSL:

Using Certbot

# Install Certbot
sudo apt install certbot

# Obtain certificate (standalone)
sudo certbot certonly --standalone -d yourdomain.com

# Or with webroot
sudo certbot certonly --webroot -w /var/www/html -d yourdomain.com

# Auto-renewal test
sudo certbot renew --dry-run

Certificate Locations

/etc/letsencrypt/live/yourdomain.com/
├── fullchain.pem    # Certificate + intermediates
├── privkey.pem      # Private key (keep secure!)
├── cert.pem         # Certificate only
└── chain.pem        # Intermediate certificates

Nginx Configuration

server {
    listen 443 ssl http2;
    server_name yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    # SSL configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    # HSTS
    add_header Strict-Transport-Security "max-age=63072000" always;

    location / {
        proxy_pass http://localhost:4000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name yourdomain.com;
    return 301 https://$server_name$request_uri;
}

Troubleshooting

Certificate Not Valid

Symptoms: Browser shows certificate error

Solutions:

  1. Check certificate hasn't expired
  2. Verify domain matches certificate
  3. Check intermediate certificates are included
  4. Ensure system time is correct

DNS Not Propagated

Check propagation:

dig yourdomain.com
nslookup yourdomain.com
# Online tools: whatsmydns.net

TTL (Time To Live):

  • Lower TTL before changes for faster propagation
  • Standard TTL: 300-3600 seconds
  • Changes can take TTL duration to propagate

Mixed Content Warnings

Symptoms: HTTPS site shows "mixed content" warning

Cause: Loading HTTP resources on HTTPS page

Fix:

  • Change all URLs to https://
  • Use protocol-relative URLs: //example.com/script.js
  • Use relative URLs: /script.js

Redirect Loops

Symptoms: Browser error "too many redirects"

Common causes:

  • Redirecting HTTP→HTTPS on load balancer that's already terminating SSL
  • Misconfigured reverse proxy
  • WordPress/site config has wrong URL

Fix: Check headers to determine actual protocol

Advanced Topics

Wildcard Certificates

Covers all subdomains:

# Obtain wildcard
certbot certonly --manual --preferred-challenges=dns \
  -d *.yourdomain.com -d yourdomain.com

Requires DNS TXT record verification.

Certificate Monitoring

Set up alerts before expiration:

# Check certificate expiration
echo | openssl s_client -servername yourdomain.com \
  -connect yourdomain.com:443 2>/dev/null | \
  openssl x509 -noout -dates

HTTP Strict Transport Security (HSTS)

Forces browsers to always use HTTPS:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Warning: Once enabled, cannot be easily disabled. Test thoroughly first.

OCSP Stapling

Improves SSL handshake performance:

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /path/to/chain.pem;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

SSL Labs Testing

Test your SSL configuration: https://www.ssllabs.com/ssltest/

Aim for A+ rating.

DNS Configuration Checklist

  • Domain registered and active
  • DNS records pointing to correct IPs/domains
  • TTL set appropriately (lower for changes)
  • Both apex and www configured
  • Propagation verified (dig/nslookup)
  • No conflicting records

SSL Configuration Checklist

  • Certificate valid and not expired
  • Private key secured (600 permissions)
  • Intermediate certificates included
  • TLS 1.2+ only (disable SSLv3, TLS 1.0/1.1)
  • Strong cipher suites
  • HSTS configured (optional, careful)
  • HTTP→HTTPS redirect in place
  • Auto-renewal configured
  • Renewal tested

Testing Your Setup

Command Line

# Test HTTPS
curl -I https://yourdomain.com

# Check certificate
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com | \
  openssl x509 -noout -text

# Test redirect
curl -I http://yourdomain.com
# Should show 301 to HTTPS

# DNS lookup
dig +short yourdomain.com
dig +short www.yourdomain.com

Online Tools

  • SSL Labs: Comprehensive SSL testing
  • WhatsMyDNS: DNS propagation checker
  • Security Headers: Header configuration check
  • SSL Checker: Certificate validation

Summary

SSL and domain configuration is critical for production:

  1. Use HTTPS everywhere: No exceptions
  2. Let platforms handle SSL: They auto-renew and configure properly
  3. Configure both apex and www: Redirect one to the other
  4. Monitor certificate expiration: Even with auto-renewal
  5. Test thoroughly: Use online tools to verify setup
  6. Plan DNS changes: Lower TTL before making changes

With proper SSL and domain configuration, your application is ready for production traffic.

Congratulations! You've completed the Vibe Coding The Smart Way guidebook. You now have the knowledge to build, deploy, and maintain AI-assisted software projects. Happy building!