Certificates & HTTPS

Answers common questions: certificates are free DV only, last 90 days (renew about every 60), the private key stays on your server, wildcards require DNS-01, and requesting a cert can attract crawler traffic because of Certificate Transparency logs.

The reference for Certbot: certonly vs installer plugins, standalone/webroot/manual/DNS validation, renewal, hooks, revocation and deletion. Read the renew and hooks sections to automate reloading your web server.

Compares HTTP-01 (file on port 80), DNS-01 (TXT record at _acme-challenge) and TLS-ALPN-01. DNS-01 is the one needed for wildcards or servers that are not publicly reachable, but it needs a DNS API and narrowly scoped credentials.

Explains Off, Flexible, Full and Full (strict). Flexible encrypts only visitor-to-Cloudflare; Full (strict) also validates the origin certificate (public CA or Cloudflare Origin CA) and is the recommended choice.

Fixes redirect loops after adding a domain to Cloudflare, usually caused by Flexible mode combined with an origin that redirects to HTTPS. Also covers Always Use HTTPS, HSTS and conflicting rules.

A zero-config tool that creates a local CA, installs it in your system trust stores and issues certificates for chosen hostnames, avoiding self-signed browser warnings during development. Never share the generated rootCA-key.pem.

A thread where a user gets a wildcard cert using DNS-01 with Cloudflare. The 'unrecognized arguments' error came from a missing DNS plugin and mixed apt/snap installs; the fix was the snap Certbot plus certbot-dns-cloudflare, then tightening the credentials file permissions.

SSL Labs flagged an incomplete chain because the server sent only the leaf certificate. The answer is to serve fullchain.pem and enable the chained certificate option (here in OpenLiteSpeed), then restart and retest.