Unit III · Going live
HTTPS and certificates
HTTPS encrypts the traffic between browser and server and lets the browser check that it is talking to your site. The certificate that makes this work expires, so renewal has to be automatic.
What HTTPS gives you
HTTPS is HTTP over TLS. Traffic is encrypted, so others on the network cannot read or quietly change it, and the server proves its identity with a certificate issued by a certificate authority that browsers trust.
Certificates expire
Let's Encrypt, a free certificate authority, issues certificates automatically through the ACME protocol. Its standard certificates are valid for 90 days today. It has announced that they will be valid for 64 days from February 10, 2027 and 45 days from February 16, 2028, and an opt-in profile already issues 45-day certificates. Short lifetimes only work with automatic renewal: if renewal breaks, visitors see browser warnings as soon as the certificate runs out.
Two common snags
Mixed content: an HTTPS page that loads a script or an image over plain HTTP; browsers block or warn about it. HSTS: a response header (Strict-Transport-Security) that tells browsers to use only HTTPS for your site for a set time, so a mistyped http:// link cannot drop to an unencrypted connection.
Words to know
- TLS
- the encryption layer under HTTPS
- Certificate authority
- an organisation browsers trust to vouch for a site's identity
- ACME
- the protocol used to get and renew certificates automatically
- HSTS
- a header telling browsers to always use HTTPS for a site
Sources
- Let's Encrypt: How It Works
- Let's Encrypt: Decreasing Certificate Lifetimes to 45 Days (Dec 2025)
- MDN Web Docs: Strict-Transport-Security
- MDN Web Docs: Mixed content
Checked October 17, 2026. Pages on other sites change; if a source no longer says what the lesson says, the source wins.