HTTPS and SSL/TLS Management
Automatic certificate provisioning, renewal, and TLS configuration.
EdgeIntermediate
Why
HTTPS is mandatory for modern web — browsers reject HTTP, and SEO/HTTP2 require TLS. Cloudflare's edge network spans 330+ cities with sub-50ms p95 latency globally.
Edge functions reduce TTFB by 60-80% compared to origin servers, and Akamai reports 40% of enterprises now use edge compute in 2024.
When
All production deployments — HTTPS is non-negotiable. Avoid edge functions for stateful logic requiring database writes — edge runtimes have no persistent connection pool.
Skip if you need long-running tasks (>30s) or heavy CPU computation.
How
# Let's Encrypt with certbot (for self-hosted)
sudo certbot certonly --standalone -d example.com
sudo certbot renew --dry-run
# Auto-renewal (cron)
0 12 * * * /usr/bin/certbot renew --quiet
# Nginx TLS config
server {
listen 443 ssl http2;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
}
4. Verify deployment — curl -I https://your-app.example.com
5. Monitor logs — check for errors in first 5 minutes
6. Rollback if needed — revert to previous version
Example
# Vercel — automatic HTTPS, no config needed
# For custom certs (Enterprise):
{
"ssl": {
"certificate": "@cert.pem",
"key": "@key.pem"
}
}
# Test SSL grade
npx ssllabs example.com
Common Problems
- ⚠Cert renewal fails — check port 80 is open for HTTP-01 challenge
- ⚠Mixed content — ensure all assets use https:// URLs
- ⚠Configuration drift between environments — use infrastructure-as-code (Terraform/Pulumi) to keep dev/staging/prod identical
Best Practices
- ✓Use TLS 1.2+ only — disable old protocols
- ✓Use HSTS — force HTTPS for all future visits
- ✓Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit