{"post":{"slug":"how-to-set-up-ssl-2026","title":"How to set up SSL in 2026: TLS, certificates, and HTTPS done right","excerpt":"HTTPS is non-negotiable in 2026 — browsers flag plain HTTP, and search engines penalize it. Here is how to get certificates, configure TLS, and stay secure.","category":"code","date":"April 3, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">S</span>SL/TLS is the foundational layer of web security, and in 2026 there is almost no excuse not to have it. Free certificate authorities, one-command automation, and built-in support in every major web server have removed every barrier. What remains is understanding the choices: which certificate type, which TLS version, which ciphers, and how to keep it all renewed.\n\n## What changed in 2026\n\n- **TLS 1.3 is now the default** in all major browsers and servers. TLS 1.2 is still acceptable; TLS 1.0 and 1.1 are blocked by Chrome, Firefox, and Safari.\n- **Let's Encrypt issued its 5 billionth certificate** — free DV certs are universal, with 90-day lifetimes and automated renewal.\n- **ACME protocol (RFC 8555) is stable** — clients like `acme.sh`, Certbot, and `Caddy` all speak it natively.\n- **Certificate Transparency logs** are mandatory for all public certs; browsers reject certs not in CT logs.\n- **Post-quantum TLS** (X25519Kyber768) is being rolled out in Chrome and Cloudflare — most servers do not need to configure it yet, but it is coming.\n\n## Certificate types explained\n\n| Type | Validation | Use case |\n| --- | --- | --- |\n| DV (Domain Validated) | Proves domain ownership | Most websites, APIs |\n| OV (Org Validated) | Proves org identity | Company sites, adds org name to cert |\n| EV (Extended Validation) | Deep org vetting | Legacy high-trust banking; less common now |\n| Wildcard (`*.example.com`) | Domain + all subdomains | Multi-subdomain setups |\n| Wildcard + root | Covers root and all subs | SaaS products with per-customer subdomains |\n\nFor most applications, a free Let's Encrypt DV certificate is the right choice.\n\n## Get a certificate with Certbot (Nginx)\n\n```bash\n# Install Certbot\nsudo apt install certbot python3-certbot-nginx -y\n\n# Issue and install certificate\nsudo certbot --nginx -d example.com -d www.example.com\n\n# Test automatic renewal\nsudo certbot renew --dry-run\n```\n\nCertbot installs a systemd timer that runs twice daily and renews certs with less than 30 days left. Verify with `systemctl list-timers | grep certbot`.\n\n## Get a certificate with acme.sh (standalone)\n\n```bash\ncurl https://get.acme.sh | sh -s email=you@example.com\n\n# HTTP-01 challenge (port 80 must be open)\n~/.acme.sh/acme.sh --issue -d example.com --webroot /var/www/html\n\n# Install to Nginx path\n~/.acme.sh/acme.sh --install-cert -d example.com \\\n  --key-file /etc/ssl/example.com.key \\\n  --fullchain-file /etc/ssl/example.com.crt \\\n  --reloadcmd \"systemctl reload nginx\"\n```\n\n`acme.sh` is useful on servers where you want more control or the Certbot package is unavailable.\n\n## Minimal Nginx TLS config (TLS 1.3 + 1.2)\n\n```nginx\nserver {\n    listen 443 ssl;\n    http2 on;\n    server_name example.com www.example.com;\n\n    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;\n    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;\n\n    ssl_protocols TLSv1.2 TLSv1.3;\n    ssl_prefer_server_ciphers off;\n    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;\n\n    ssl_session_timeout 1d;\n    ssl_session_cache shared:MozSSL:10m;\n    ssl_session_tickets off;\n\n    # HSTS — add only after confirming HTTPS works\n    add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\" always;\n\n    # OCSP Stapling\n    ssl_stapling on;\n    ssl_stapling_verify on;\n    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;\n    resolver 1.1.1.1 1.0.0.1 valid=300s;\n}\n\n# HTTP redirect\nserver {\n    listen 80;\n    server_name example.com www.example.com;\n    return 301 https://$host$request_uri;\n}\n```\n\nThis is the Mozilla \"Intermediate\" configuration — compatible with all modern clients.\n\n## How to check your TLS config\n\n| Tool | What it checks |\n| --- | --- |\n| `ssl-checker.com` or Qualys SSL Labs | Full grade, cipher support, chain validation |\n| `openssl s_client -connect example.com:443` | Protocol and cert from the command line |\n| `curl -vI https://example.com` | Certificate dates and chain |\n| Mozilla SSL Config Generator | Generates correct server configs for your version |\n\nAim for an A or A+ on SSL Labs for any production site.\n\n## How to pick\n\n1. **Simple site or API on a single domain** → Certbot `--nginx` or `--apache`, done in one command.\n2. **Multiple subdomains** → Wildcard cert via DNS-01 challenge (`acme.sh` or Certbot DNS plugin).\n3. **Kubernetes** → `cert-manager` with Let's Encrypt ClusterIssuer; certificates as CRDs.\n4. **CDN (Cloudflare, Fastly)** → Use \"Full (strict)\" mode with an origin certificate; the CDN handles the client-facing TLS.\n5. **Internal services** → A private CA (e.g., `step-ca`) issues short-lived certs without Let's Encrypt rate limits.\n\n## Common mistakes\n\n**Not redirecting HTTP to HTTPS.** Without the HTTP `return 301` block, users who type `http://` get a plain-text connection.\n\n**Using `ssl_protocols TLSv1` or `TLSv1.1`.** Remove these — they are cryptographically broken.\n\n**Setting HSTS before confirming HTTPS works.** Once the header is sent with a long `max-age`, browsers enforce HTTPS and the only fix is to wait for it to expire. Test thoroughly first.\n\n**Not monitoring certificate expiry.** Even with auto-renewal, monitors catch failures. Add an uptime check that alerts on cert expiry within 14 days.\n\n**Forgetting the chain file.** Using only the leaf cert causes \"untrusted\" errors on some clients. Always use `fullchain.pem`.\n\n## What to skip\n\n- **Self-signed certificates on public-facing services** — browsers show alarming warnings; trust is destroyed.\n- **Pinning TLS certificates** in mobile apps unless your threat model specifically requires it; it creates brittle upgrade paths.\n- **TLS termination inside every microservice** for internal traffic — a service mesh or mTLS with short-lived internal certs is the better pattern.\n\n## FAQ\n\n**How long do Let's Encrypt certificates last?**\n90 days. Certbot and acme.sh auto-renew at ~60 days; you should never notice the renewal.\n\n**Do I need to pay for a certificate?**\nNo, for DV certificates. OV/EV certificates from commercial CAs cost money and add organization validation, but for most purposes DV is sufficient.\n\n**What is OCSP stapling?**\nIt lets the server prove the certificate has not been revoked without the client making a separate request to the CA. Enable it for better performance and privacy.\n\n**What does \"certificate chain\" mean?**\nYour certificate is signed by an intermediate CA, which is signed by a root CA. The chain file includes both; without it some older clients cannot verify trust.\n\n## Where to go next\n\n- [How to set up Nginx in 2026](/blog/how-to-set-up-nginx-2026)\n- [How to containerize an app in 2026](/blog/how-to-containerize-an-app-2026)\n- [How to build a REST API in 2026](/blog/how-to-build-a-rest-api-2026)","hue":309,"metaTitle":"How to Set Up SSL/TLS in 2026: Certificates and HTTPS Guide","metaDescription":"Set up SSL/TLS in 2026 — get free Let's Encrypt certs, configure TLS 1.3, enforce HSTS, and avoid common certificate mistakes. Practical guide.","keywords":["how to set up ssl 2026","tls certificate setup 2026","lets encrypt certbot 2026","https configuration nginx","tls 1.3 setup","ssl certificate best practices","hsts configuration","acme.sh certificate","ssl termination reverse proxy","ssl tls security 2026"],"tldr":["**Use Let's Encrypt via Certbot or ACME.sh** for free, auto-renewing certificates on any server.","**Enforce TLS 1.2 minimum; prefer TLS 1.3** — TLS 1.0 and 1.1 are deprecated and widely blocked.","**Set HSTS with a long max-age** once HTTPS is stable — it prevents protocol downgrade attacks.","**Use a strong cipher suite** and disable weak ciphers; Mozilla SSL Config Generator gives you copy-paste configs.","**Skip:** self-signed certificates for anything user-facing — they destroy trust, trigger browser warnings, and offer no real benefit over Let's Encrypt."],"readTime":"4 min read","wordCount":984},"related":[{"slug":"how-to-set-up-nginx-2026","title":"How to set up Nginx in 2026: reverse proxy, HTTPS, and performance basics","excerpt":"Nginx is still the default reverse proxy for most production stacks in 2026. This guide covers installation, virtual hosts, HTTPS via Certbot, and tuning.","category":"code","date":"March 16, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":308},{"slug":"ssl-tls-explained-2026","title":"SSL/TLS explained in 2026: how HTTPS actually secures your connection","excerpt":"TLS 1.3 is now the minimum bar, certificate lifetimes are shrinking to 90 days, and post-quantum handshakes are shipping. Here is the full picture.","category":"code","date":"April 7, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":311},{"slug":"http-vs-https-2026","title":"HTTP vs HTTPS in 2026: why plain HTTP is effectively dead","excerpt":"HTTPS is no longer optional and has not been for years. This 2026 guide explains the technical differences, TLS 1.3 improvements, and what still trips teams up.","category":"code","date":"March 18, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":306}],"sameCategory":[{"slug":"bazel-build-explained-2026","title":"Bazel Explained: What Hermetic Builds Actually Cost","excerpt":"Bazel delivers reproducible, precisely cached builds and demands that you describe everything. Here is what you get, what it costs, and who should say no.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":145},{"slug":"graphql-federation-2026","title":"GraphQL Federation: One Graph, Many Teams","excerpt":"Federation composes independently-owned subgraphs into a single API. Here is what it solves, the operational cost it adds, and when a simpler gateway is enough.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":300},{"slug":"hermetic-builds-explained-2026","title":"Hermetic Builds Explained: Same Inputs, Same Output","excerpt":"A hermetic build depends only on declared inputs. Here is what that property gives you, the common leaks that break it, and how to move toward it incrementally.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":130},{"slug":"monorepo-tooling-compared-2026","title":"Monorepo Tooling Compared: What You Actually Need","excerpt":"Monorepo tools solve task orchestration and caching, not repository layout. Here is what each tier provides and how to tell when you have outgrown the simple option.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":150}],"newer":{"slug":"how-to-set-up-pre-commit-hooks-2026","title":"How to set up pre-commit hooks in 2026","excerpt":"Pre-commit hooks catch formatting errors, lint failures, and secrets before they reach CI. Here is how to set them up reliably in 2026.","category":"code","date":"April 3, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":307},"older":{"slug":"how-to-set-up-storybook-2026","title":"How to set up Storybook in 2026","excerpt":"Storybook 8 is faster, Vite-native, and ships a built-in test runner. This guide covers installation, story writing, interaction testing, and plugging Storybook into CI.","category":"code","date":"April 3, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":317}}