HTTPS everywhere: redirects, HSTS and certificate renewal

Goal

Make plaintext access impossible in practice and certificate expiry a non-event.

Prerequisites

Control of DNS for every hostname served and a reverse proxy or web server with an ACME client.

Steps

1. Issue certificates automatically through ACME (RFC 8555) for each hostname, including www and any API hosts; monitor expiry dates.
2. Redirect all HTTP requests to the HTTPS canonical address with a permanent status, preserving path and query; do not redirect API POSTs across schemes in ways that drop bodies.
3. Send Strict-Transport-Security: max-age=31536000; includeSubDomains on HTTPS responses once every subdomain is ready; RFC 6797 defines the header and its semantics.
4. Verify from outside: certificate chain for each hostname, IPv4 and IPv6, the redirect, and the HSTS header.
5. Keep TLS configuration to the platform's modern defaults; avoid manual cipher lists that go stale.

Expected result

Browsers that have seen the site once refuse to connect over HTTP; certificates renew without intervention; no hostname serves an expired or mismatched certificate.

Limits and test basis

HSTS preload is a commitment that is hard to undo; add it only when certain. Internal hostnames without public DNS need a different issuance path. Procedures follow the cited RFCs and this site's own setup.

Goal

Make plaintext access impossible in practice and certificate expiry a non-event.

Prerequisites

Control of DNS for every hostname served and a reverse proxy or web server with an ACME client.

Steps

1. Issue certificates automatically through ACME (RFC 8555) for each hostname, including www and any API hosts; monitor expiry dates.
2. Redirect all HTTP requests to the HTTPS canonical address with a permanent status, preserving path and query; do not redirect API POSTs across schemes in ways that drop bodies.
3. Send Strict-Transport-Security: max-age=31536000; includeSubDomains on HTTPS responses once every subdomain is ready; RFC 6797 defines the header and its semantics.
4. Verify from outside: certificate chain for each hostname, IPv4 and IPv6, the redirect, and the HSTS header.
5. Keep TLS configuration to the platform's modern defaults; avoid manual cipher lists that go stale.

Expected result

Browsers that have seen the site once refuse to connect over HTTP; certificates renew without intervention; no hostname serves an expired or mismatched certificate.

Limits and test basis

HSTS preload is a commitment that is hard to undo; add it only when certain. Internal hostnames without public DNS need a different issuance path. Procedures follow the cited RFCs and this site's own setup.

Preloading is nearly irreversible

Submission to the browser preload lists requires includeSubDomains and preload with a long max-age; removal takes months to reach users. Before submitting, inventory every subdomain (including internal, test and vendor-hosted ones) and confirm each serves valid HTTPS. Treat preloading as a one-way decision made deliberately, not as the last step of a checklist.