Module 66: Web Server Configuration
TLS and HTTPS
🏠The everyday picture
A sealed envelope with an official stamp: nobody on the way can read or alter the letter, and the stamp proves who sent it. Plain HTTP is a postcard anyone can read.
📘What it really is
- HTTPS is HTTP inside TLS encryption (Module 6). It:
- keeps passwords, cookies and data private in transit;
- stops anyone on the network from changing pages (injecting ads or malware);
-
proves the site is really yours, through a certificate.
-
Browsers mark HTTP sites "Not secure", and many features (secure cookies, Module 44; service workers; geolocation) need HTTPS.
-
Let's Encrypt gives free certificates, renewed automatically. Certbot sets them up for Nginx:
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d crm.example.in
It needs a real domain pointing at a server reachable from the internet (not a lab-only name).
-
Certbot adds the certificate to your server block and a redirect from HTTP to HTTPS, and a timer renews certificates before they expire (check with
sudo certbot renew --dry-run). -
After HTTPS works, add HSTS (
Strict-Transport-Security), so browsers always use HTTPS for your site (Module 48). - Check your setup with SSL Labs' free server test (ssllabs.com/ssltest): aim for an A.
- Your Hostinger test site's HTTPS works the same way, managed by Hostinger.
🖱️Try it
If you have a VPS and a domain or subdomain: point an A record at the VPS, set up the server block, and run Certbot. Visit the site over HTTPS, check the padlock, and run the SSL Labs test. (In a lab without a public address, read Certbot's documentation and note the steps; you'll do it for real in the Level 6 project.)
✅Quick check
What does HTTPS protect against?
Show the answer
Others reading or changing data in transit, and impersonating your site.
How do Let's Encrypt certificates stay valid?
Show the answer
They're renewed automatically by a scheduled job before they expire.