HTTPS & TLS Certificates
Why every production endpoint needs TLS, and the free way to get a certificate.
45 minOverview
HTTPS encrypts traffic between the client and your server using a TLS certificate. Without it, anything sent to your API — including auth tokens and passwords — travels as plain, readable text over the network.
Why it matters
Browsers actively warn users off HTTP-only sites now, and modern web features (secure cookies, service workers, HTTP/2) simply require HTTPS to function at all. It's not an optional hardening step anymore — it's baseline.
How backend developers use it
Let's Encrypt via Certbot for a free, auto-renewing certificate on a self-managed server behind Nginx; platforms like Railway and Vercel provision and renew certificates automatically for any domain you attach, so most of the time this is zero-config once DNS is pointed correctly.
Common mistakes
Warning
Letting a certificate expire because renewal wasn't automated — Certbot's cron job or systemd timer needs to actually be verified as running, not assumed.
Warning
Mixed content: an HTTPS page loading an image or script over plain HTTP, which browsers block or warn on.
Warning
Not redirecting HTTP to HTTPS at the server level, leaving an unencrypted path still reachable.
Warning
Treating an expired-certificate warning as cosmetic instead of a blocking incident — an expired cert breaks every client that validates certificates, which is nearly all of them.
Example commands
Get a free certificate via Certbot for an Nginx site
certbot --nginx -d api.example.com
Dry-run a renewal to confirm it'll work
certbot renew --dry-run
Check a certificate's expiry from the command line
openssl s_client -connect api.example.com:443 -servername api.example.com | openssl x509 -noout -dates
Resources
Retrieval check
Before you continue
- Explain what this tool or practice changes in the delivery lifecycle.
- Name one common failure it helps you diagnose or prevent.
- Repeat one example command from memory, then verify it.