A small TLS checklist for small servers
Nothing in this post is new; it is the checklist I wish I'd had the first time I got paged because a reverse proxy silently expired a certificate.
Terminate in one place
Every service behind the proxy speaks plain HTTP on a private network. TLS is the proxy's job, the certificates live in one directory, and renewal is one timer. The moment two components each hold a copy of a key, one of them will be the stale one.
Renew early, alert on age
Automated renewal will fail eventually — DNS changes, an account gets rate-limited, a webroot moves. The alert I trust is not "renewal failed" but "certificate served on :443 has fewer than 20 days left", checked from outside the machine. That catches the failures you didn't anticipate.
echo | openssl s_client -connect example.org:443 -servername example.org 2>/dev/null \
| openssl x509 -noout -enddateServe something real on the root
A domain that answers on 443 with a valid certificate and a blank page looks like a mistake. Put a real, if modest, site there. It costs nothing and it makes the whole setup easier to reason about when you come back to it in a year.
Keep HTTP alive
Port 80 should redirect to HTTPS and nothing else — except for the ACME challenge path, which is the one thing that must keep working when everything else is broken.