How to Configure SSL Certificates and HTTPS on a Production Server

Securing a website is essential for protecting user information, building trust, and maintaining a reliable online presence. When a website runs without HTTPS, data exchanged between the browser and server may be vulnerable to interception or modification.

SSL certificates and HTTPS help protect communication between users and web servers by encrypting data in transit. They are especially important for business websites, e-commerce platforms, web applications, login pages, and systems that handle sensitive information.

In this guide, we will explain how to configure an SSL certificate and enable HTTPS on a production server using Nginx and Let's Encrypt.

What Is an SSL Certificate?

An SSL certificate helps a browser verify a website's identity and establish an encrypted connection. Modern websites use TLS (Transport Layer Security), although the term SSL certificate is still widely used.

When a website has a valid certificate and HTTPS configured correctly, browsers can establish a secure connection with the server.

HTTPS provides several benefits:

• Data encryption: Helps protect information exchanged between users and the server.

• Website authentication: Helps browsers verify that they are communicating with the intended website.

• User trust: Displays a secure connection indicator in supported browsers.

• Data integrity: Helps protect information from being modified in transit.

• Security best practices: Supports safer communication for business websites and web applications.

HTTPS does not automatically make an entire website secure. Server updates, application security, access controls, and safe handling of user data are also important.

What You Need Before Configuring HTTPS

Before installing an SSL certificate, make sure you have:

• A production server running Linux, such as Ubuntu.

• A registered domain name pointing to your server's public IP address.

• Nginx installed and configured to serve your website.

• SSH access with the required administrative permissions.

• Ports 80 and 443 allowed through the server firewall and cloud network rules.

• A working website configuration for your domain.

For this tutorial, we will use Ubuntu, Nginx, and a free certificate from Let's Encrypt. The same principles apply to other hosting environments, although the commands may differ.

Step 1: Point Your Domain to the Production Server

First, configure your domain's DNS records to point to the server.

For example:

• An A record points example.com to your server's IPv4 address.

• A CNAME record can point www.example.com to example.com.

• An AAAA record points to an IPv6 address if your server is correctly configured for IPv6.

Replace example.com with your actual domain name.

Wait for the DNS changes to propagate, then confirm that the domain resolves to the correct server. Incorrect DNS records can prevent certificate issuance or cause visitors to reach the wrong server.

Step 2: Install and Configure Nginx

If Nginx is not installed, update the package list and install it:

sudo apt update
sudo apt install nginx

Enable and start the service:

sudo systemctl enable --now nginx
sudo systemctl status nginx

Configure a server block for your domain. For a static website, a basic example is:

server {
    listen 80;
    server_name example.com www.example.com;

    root /var/www/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Save the configuration in an appropriate file under /etc/nginx/sites-available/, enable it using a symbolic link in /etc/nginx/sites-enabled/, and test the configuration:

sudo nginx -t
sudo systemctl reload nginx

If your website uses a Node.js backend or another application server, the Nginx configuration may need a reverse proxy instead of serving static files directly.

Step 3: Install Certbot

Certbot is a tool that helps obtain and renew certificates from Let's Encrypt.

On Ubuntu, you can install it using the package manager:

sudo apt update
sudo apt install certbot python3-certbot-nginx

For production environments, check the current Certbot and Let's Encrypt installation guidance for your operating system and preferred installation method.

Step 4: Obtain and Install the SSL Certificate

Once DNS and Nginx are configured, run:

sudo certbot --nginx -d example.com -d www.example.com

Replace the example domains with the names configured for your website.

Certbot will attempt to verify domain ownership, obtain the certificate, and update the Nginx configuration. Follow the prompts to complete the process.

If the command succeeds, the certificate and HTTPS configuration should be ready for use. If domain validation fails, check DNS records, firewall rules, and whether the domain is reachable from the internet.

Step 5: Enable HTTPS and Redirect HTTP Traffic

HTTPS normally uses port 443, while HTTP uses port 80. After certificate installation, visit your website using:

https://example.com

If you did not configure an HTTP-to-HTTPS redirect during installation, you can configure one in Nginx. For example:

server {
    listen 80;
    server_name example.com www.example.com;

    return 301 https://$host$request_uri;
}

Test the configuration before reloading Nginx:

sudo nginx -t
sudo systemctl reload nginx

Only enable this redirect after confirming that HTTPS works correctly for the domain. Also ensure that all required hostnames have valid certificates and that the server configuration handles them appropriately.

Step 6: Verify the SSL Certificate and HTTPS Setup

After enabling HTTPS, test the website in a browser and confirm that the certificate is valid, trusted, and issued for the correct domain.

You can also inspect the certificate from the command line:

openssl s_client \
  -connect example.com:443 \
  -servername example.com

Review the certificate details, expiry date, and verification result. You can use a reputable TLS testing service to identify additional configuration issues, such as outdated protocols or weak cipher settings.

Check the following:

• The website loads over HTTPS without certificate warnings.

• HTTP requests redirect to HTTPS where intended.

• All pages and assets load securely.

• API requests use HTTPS.

• There are no mixed-content warnings caused by insecure resources.

• The certificate covers both the root domain and any required subdomains.

Step 7: Configure Automatic SSL Certificate Renewal

Let's Encrypt certificates have a limited validity period, so renewal must be managed to prevent unexpected expiry.

Certbot commonly installs a systemd timer or another scheduled renewal mechanism, depending on how it was installed.

Check the renewal timer:

systemctl list-timers | grep certbot

Test the renewal process:

sudo certbot renew --dry-run

A successful dry run helps confirm that renewal is configured correctly. If you use a different certificate provider or installation method, follow that provider's renewal procedure.

For production systems, configure monitoring or alerts for certificate expiry and investigate any failed renewal attempts promptly.

Common SSL and HTTPS Configuration Problems

Even with the correct tools, SSL setup can fail for several reasons.

Certificate issuance fails: Verify that DNS records point to the correct server and that the required validation method can reach the server.

HTTPS shows a certificate warning: Check the certificate's expiry date, domain names, certificate chain, and Nginx configuration.

The website works on HTTP but not HTTPS: Confirm that port 443 is allowed by the server firewall and cloud security rules, and that Nginx has a valid HTTPS server block.

Some resources are not secure: Replace HTTP resource URLs with HTTPS and check for mixed content in browser developer tools.

The certificate expires unexpectedly: Check Certbot renewal timers, scheduled jobs, DNS validation credentials, and renewal logs.

Best Practices for Production SSL Configuration

Follow these practices to maintain a secure and reliable production environment:

1. Use valid TLS certificates from a trusted certificate authority.

2. Redirect HTTP traffic to HTTPS after verifying the secure site works correctly.

3. Renew certificates automatically and monitor their expiry.

4. Keep the operating system, Nginx, and application dependencies updated.

5. Use modern TLS protocols and secure server configuration.

6. Protect private keys with appropriate file permissions and restricted access.

7. Ensure all website pages, APIs, and resources use HTTPS.

8. Test certificate renewal and server configuration changes before relying on them in production.

9. Monitor certificate validity and investigate failed renewals.

10. Consider enabling HTTP Strict Transport Security (HSTS) only after confirming that HTTPS works consistently across all intended hostnames.

Conclusion

Configuring SSL certificates and HTTPS on a production server is an important step toward protecting users and establishing a trustworthy online presence. With Nginx, Certbot, and Let's Encrypt, you can enable HTTPS, redirect HTTP traffic, and automate certificate renewal on many Linux servers.

For production websites, remember that installing a certificate is only one part of server security. Regular updates, secure application configuration, monitoring, and reliable renewal procedures are equally important.

Need help securing your production website? Dotcube Technologies helps businesses deploy and maintain secure web applications, configure cloud servers, and implement reliable hosting and deployment practices.