HTTPS for Your Own Site: SSL Certificates, HSTS, and Mixed Content Fixes
1. Choosing a Certificate and Auto-Renewal: Skip OV Certificates and Never Renew by Hand
Many site owners buy a paid SSL certificate the first year, forget to renew it the second, and get hit with a red browser warning. The counterintuitive conclusion: for the vast majority of B2B sites, a free Let’s Encrypt DV certificate is more than enough. You still get OCSP stapling and an A+ rating, and the company name that a paid OV certificate adds has no measurable effect on conversion.
Only two hard requirements matter when choosing a certificate. First, the key algorithm: pick ECDSA P-256 over RSA 2048. The handshake is 40% smaller and the first load on mobile is about 80 milliseconds faster. Second, the renewal method: you must use certbot or acme.sh for auto-renewal, with crontab checking once a day. Never renew by hand. In 90% of certificate expiration incidents, the person responsible left the company or simply forgot.
| Certificate Type | Annual cost | Browser Display | Best for | Recommendation |
|---|---|---|---|---|
| Let’s Encrypt DV ECDSA | Free | Padlock, no company name | Most B2B sites | Default choice, auto-renewal |
| Let’s Encrypt DV RSA | Free | Padlock, no company name | Legacy device compatibility | Only if you have IE11 traffic |
| Paid OV certificate | 2,000-8,000 yuan/year | Green company name | Finance, payments, high-ticket | Don’t buy unless required |
| Paid EV certificate | 5,000-20,000 yuan/year | EV badge (removed by most browsers) | Almost no use case | Not recommended |
Example: a SaaS company in Hangzhou going global uses acme.sh to request a Let’s Encrypt certificate, with crontab set to 0 3 * * 1 /root/.acme.sh/acme.sh –renew -d example.com, checking and renewing automatically at 3 a.m. every Monday. Add a monitoring rule at the same time: alert via WeCom when the certificate has less than 15 days left. Set this up once and you won’t touch it again for two years.
How to handle multiple domains and wildcards, and CDN global acceleration node certificate strategy should be planned together. CDN providers usually supply edge certificates, and origin and edge certificates should be managed separately. Don’t let edge certificate renewal depend on the origin.
2. HSTS: Upgrade Gradually, Not All at Once
HSTS (HTTP Strict Transport Security) is the response header that forces browsers to use HTTPS. What’s counterintuitive is this: the longer you set max-age, the safer it is, but also the more dangerous. If you set max-age=31536000 right out of the gate, your test environment, staging subdomains, and internal admin panel will be unable to use HTTP for a year, and if the certificate ever has a problem, the whole site goes down.
The right upgrade pace has three stages: week one, max-age=300 (5 minutes), and watch for user complaints and business anomalies; weeks two through four, max-age=86400 (1 day), and confirm nothing is wrong; only after a month do you move up to max-age=31536000 (1 year) and add includeSubDomains. Submitting to the preload list should come even later; wait until it has run stably for 3 months before submitting to the chromium preload.
| Stage | How to write the HSTS header | Observation window | Risk Points |
|---|---|---|---|
| Tier 1 | Strict-Transport-Security: max-age=300 | 1 week | Almost no risk, can roll back at any time |
| Tier 2 | max-age=86400 | 1 month | Some older browsers may not be compatible |
| Tier 3 | max-age=31536000; includeSubDomains | 3 months | All subdomains must be HTTPS-ready |
| Final stage | Add the preload directive and submit to hstspreload.org | Long term | Extremely costly to remove after submission |
Example scenario: an industrial equipment exporter’s site has HTTPS on the main domain example.com, but legacy.example.com is still HTTP. Turning on includeSubDomains right away would lock out users of the legacy subdomain. The right approach is to first make all subdomains HTTPS, then gradually push the main site’s HSTS to a one-year term. You can see the subdomain list in the SSL Labs test report.
HSTS and Compliance foundation for global sites the transport security requirements in it are consistent: GDPR’s encryption requirement for personal data transmission is most directly implemented technically by HSTS.
3. Mixed content: automatic upgrade plus manual cleanup, two steps
Mixed content means resources loaded over the http:// protocol on an HTTPS page. There are two types: passive mixed content (images, videos, fonts), which browsers automatically block without an error; and active mixed content (
FAQ
Is a free Let's Encrypt certificate enough, or should I buy a paid OV one?
Can I set max-age=31536000 for HSTS the first time?
How do I fix mixed content in bulk? Is there a one-click tool?
How do I set up automatic certificate renewal, and what are the worst pitfalls?
Does HTTPS affect SEO? Do I need HTTPS site-wide?
How should I configure TLS versions? Should I disable TLS 1.0 and 1.1?
Final thoughts
People treat HTTPS setup as a one-and-done certificate install, but it's actually the foundation of both site security and SEO. Expired certificates, missing HSTS, and leftover mixed content each trigger a red browser warning, and buyers close the page the moment they see one. Your SEO rankings take a hit too. Set it up once, audit it monthly. The cost is low, and the payoff is visible across your entire site.
Three steps to get there: first, clear the certificate hurdle with Let's Encrypt auto-renewal and get an A or better on SSL Labs. Then raise HSTS through three stages, from a 5-minute max-age up to one year. Finally, cut mixed content to zero using upgrade-insecure-requests plus manual cleanup. Only after these three steps is HTTPS truly configured. For the ongoing maintenance checklist, see Six Monthly Tasks for Site Maintenance, and add the HTTPS audit to it.
One line worth remembering: HTTPS isn't done once you install a certificate. Auto-renewal, gradual HSTS upgrades, and zero mixed content, all three layers cleared, is what real HTTPS means. Miss one layer, and the browser's red warning will drive your buyers away for you.