The padlock, and what it does not prove

What a certificate actually claims

A TLS certificate says one thing: at the moment this was issued, whoever asked for it could prove they controlled this domain name.

That is the whole claim. It does not say the company is real, registered, honest, or the one you meant to visit. A domain-validated certificate is free and takes about thirty seconds, which means anyone who can register add4ly-login.com can put a padlock on it. Most phishing pages served today are on HTTPS. The padlock means the connection is private; it says nothing about who is on the other end.

What you get from it is still worth having, and it is not optional. Without TLS, everything is readable and editable in transit: passwords, session cookies, the page itself. Public wifi and hostile ISPs have both injected ads into plain HTTP pages, at scale. Browsers now mark HTTP as not secure, HTTP/2 in practice requires TLS, and a payment provider will not talk to you without it.

Getting one for nothing

Let’s Encrypt issues certificates free, through an automated protocol called ACME. Practically every tool speaks it.

• Caddy does it with no configuration at all beyond your domain name. Free.
• Certbot does it for nginx and Apache, and writes the config for you. Free.
• Any managed platform (Cloudflare, Vercel, Fly, Netlify, Render) does it for you and you never see it.

Paid DV certificates from a reseller cost roughly $10 to $70 a year and give you the same padlock, plus a warranty that nobody has ever successfully claimed. Extended Validation certificates used to show the company name in the URL bar, which was the one thing you were buying; Chrome and Firefox stopped displaying it in 2019. There is no remaining reason for a small site to pay.

Ninety days, and the renewal is the outage

Let’s Encrypt certificates last 90 days. The convention is to renew at 60, leaving 30 days of slack for a failing cron job to be noticed.

This is where certificates actually take sites down. Not attacks: expiry. And the safety net you may be remembering is gone: Let’s Encrypt stopped sending expiry-warning emails in mid-2025. Nothing will tell you. Shorter-lived certificates, measured in days rather than months, are being rolled out across the industry, which makes automatic renewal mandatory rather than merely sensible.

Check any site’s dates from a terminal:

echo | openssl s_client -connect addaly.com:443 -servername addaly.com 2>/dev/null \
  | openssl x509 -noout -dates -subject

Put that in a monitor that shouts at 21 days remaining. It is five minutes of work against the single most common self-inflicted outage in this course.

The two ways of proving you own the name

• HTTP-01. The issuer asks for a file at /.well-known/acme-challenge/<token> on port 80. Simple, and the default. It needs port 80 reachable from the internet, and it cannot issue wildcards.
• DNS-01. You publish a TXT record at _acme-challenge.example.com. This works for wildcard certificates, works when the machine is not publicly reachable, and needs API access to your DNS provider.

If your renewal keeps failing, it is nearly always one of these two preconditions quietly changing: a firewall rule that closed port 80, or a DNS API token that expired.

The failures you will actually meet

• The certificate covers example.com but not www.example.com. They are two names. Both must be on the certificate, or the visitor who types www gets a full-page security warning.
• A missing intermediate chain. Your browser looks fine, because browsers cache intermediate certificates from other sites you have visited. curl, Android, and your payment provider’s webhook do not. This is why “it works in Chrome” is not a test. Use openssl s_client or SSL Labs.
• The renewal ran but nothing reloaded. New certificate on disk, old certificate in memory. Your renewal hook must reload the web server, and the cron user must have permission to do it.
• Rate limits. Testing your automation against the production issuer will lock you out for a week. Use the staging endpoint while you are getting it working.
• Clock skew. A server whose clock is wrong will reject a perfectly good certificate as not yet valid.

HSTS: the header you cannot take back

Strict-Transport-Security tells browsers to refuse plain HTTP for your domain for a stated period.

Strict-Transport-Security: max-age=31536000; includeSubDomains

That is a year. Every browser that has seen it will refuse to load your site over HTTP, and there is no way to reach those browsers and change your mind. If a subdomain of yours is HTTP-only, includeSubDomains takes it offline.

Start at max-age=300, confirm nothing breaks, then raise it in steps. The HSTS preload list, which bakes your domain into the browsers themselves, is close to permanent: removal takes months to reach users. Do not submit a domain you are still experimenting with.

Mixed content

One http:// image URL on an HTTPS page and the browser blocks it silently. Grep your templates and your database content for http:// before launch, and again after anyone pastes a URL into a CMS field.