SSL/TLS explained for web developers

Every developer knows HTTPS is required. Fewer understand what it actually does, how certificates work, or why they sometimes expire and break things. Here's the practical version.

What TLS does (and what it doesn't)

TLS (what people mean when they say "SSL") does two things:

1. Encryption — data between the browser and your server can't be read by anyone in between (your ISP, a coffee shop's router, etc.)
2. Authentication — the browser verifies that it's talking to your server, not an impersonator

TLS does not secure your server itself, protect against SQL injection, or encrypt data at rest. It only protects data in transit between browser and server.

Certificates and Certificate Authorities

A TLS certificate is a signed document that says: "This public key belongs to the owner of example.com." The signature comes from a Certificate Authority (CA) — a trusted third party whose root certificate is built into browsers and operating systems.

When your browser visits https://example.com, it:

1. Downloads the server's certificate
2. Verifies the signature from a trusted CA
3. Verifies the certificate's domain matches the URL
4. Checks the certificate hasn't expired
5. Proceeds with an encrypted connection if all checks pass

Let's Encrypt

Let's Encrypt is a free, automated CA that changed the web. Before it launched in 2015, certificates cost $50–200/year and required manual renewal. Let's Encrypt made HTTPS free and automated.

Let's Encrypt certificates expire every 90 days by design — to encourage automation and reduce the impact of a compromised key. Properly configured servers renew automatically.

How Simplewala handles SSL

When you add a domain to the Front Door proxy, Simplewala:

1. Verifies you control the domain by serving a challenge file at http://yourdomain.com/.well-known/acme-challenge/
2. Requests a certificate from Let's Encrypt
3. Configures Nginx to use it
4. Sets up automatic renewal via a cron job

You never think about renewal — the certificate renews itself 30 days before expiry.

HTTP Strict Transport Security (HSTS)

Once you have HTTPS, enable HSTS to tell browsers to only ever connect to your domain over HTTPS — even if someone types http://:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Simplewala's Front Door adds this header automatically.

TLS versions

SSLv3, TLS 1.0, and TLS 1.1 are deprecated and have known vulnerabilities. Modern configurations should only allow TLS 1.2 and TLS 1.3. Simplewala's Nginx config enforces this by default.

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:...;

Testing your SSL config

Use SSL Labs to test your server's TLS configuration. A properly configured Simplewala server should score A or A+.

Common certificate errors

• ERR_CERT_COMMON_NAME_INVALID — domain doesn't match certificate. Usually caused by missing www redirect or typo in domain.
• ERR_CERT_DATE_INVALID — certificate expired. Check renewal cron: systemctl status certbot.timer
• ERR_SSL_PROTOCOL_ERROR — usually Nginx config issue. Check logs: journalctl -u nginx