We still say SSL, but modern HTTPS uses TLS. The practical job is to prove the hostname, install the right certificate, and renew it before users notice.
A certificate binds a public key to a hostname through a trusted certificate authority. The browser and server negotiate encrypted traffic, protecting data in transit and authenticating the site endpoint.
Table of contents
- Understand the moving parts
- Issue and install a certificate
- Redirect the whole site to HTTPS
- Automate renewal and monitor
- How this fits the rest of the stack
- FAQ
Understand the moving parts
- Domain name: the hostname users request.
- DNS: points that hostname toward the service.
- Certificate: covers the hostname and contains the public key.
- Private key: remains secret on the server or managed platform.
- Certificate chain: links the site certificate to a trusted authority.
- TLS configuration: selects protocols, ciphers, and application behaviour.
Issue and install a certificate
Point DNS correctly, then prove control using an HTTP or DNS challenge. Managed platforms often automate issuance and installation. On a self-managed server, use a well-supported ACME client and protect the private key with strict permissions.
Include every public hostname you intend to serve, such as the apex domain and www. A certificate for one does not automatically cover the other.
Redirect the whole site to HTTPS
Once HTTPS works directly, redirect HTTP requests to the matching HTTPS URL with a permanent redirect. Update canonical URLs, sitemaps, API endpoints, webhooks, and asset references. Mixed-content errors occur when an HTTPS page still loads an HTTP script, image, font, or stylesheet.
Add HSTS only after every required subdomain supports HTTPS and you understand the persistence. A premature includeSubDomains rule can lock users out of forgotten hosts.
Automate renewal and monitor
Short-lived certificates are safe only when renewal is reliable. Test the renewal command or managed workflow, ensure challenges remain reachable, reload the server after replacement, and alert well before expiry.
Check hostname coverage, chain completeness, protocol support, redirects, and application behaviour from outside your network. Back up configuration, not private keys that a managed platform owns.
How this fits the rest of the stack
HTTPS is a lifecycle: DNS, issuance, installation, redirects, renewal, and monitoring. RunxBuild manages certificates for connected domains; estimate the site in the RunxBuild calculator and configure it from the RunxBuild dashboard.
Useful related references:
- How to Renew an SSL Certificate: A 2026 Guide
- Unlimited SSL: What That Phrase Is Actually Selling
- What Does SSL Mean? And Why Nobody Actually Uses SSL Anymore
- Custom domains and certificates on RunxBuild
FAQ
What is the difference between SSL and TLS?
SSL is the older protocol family; modern secure web connections use TLS, though SSL remains the common label.
Do I need to buy an SSL certificate?
Not necessarily. Many hosts automate certificates from public certificate authorities, while specialised certificate types may have different needs.
Why does HTTPS show a certificate warning?
Common causes include expiry, hostname mismatch, an incomplete chain, an untrusted issuer, or an incorrect system clock.
What is mixed content?
It is an HTTPS page loading one or more resources over insecure HTTP, which browsers may block or warn about.