DevOps: SSL automation
This course explains how HTTPS works for a Rails application behind a proxy and how its certificates are obtained and renewed automatically. It starts with what assume_ssl, force_ssl and the /up health check exclusion do. It then covers certificates, the chain of trust and the ACME challenge types used by Let's Encrypt. Later lessons treat renewal timing, rate limits, forwarding headers, HSTS, mixed content, wildcards versus SAN lists, and certificate transparency. The last lesson applies all of it to this application with kamal-proxy, Cloudflare and an expiry check.
What you'll learn
- ✓What assume_ssl and force_ssl do behind a TLS-terminating proxy
- ✓How certificates, Subject Alternative Names and the intermediate chain are validated
- ✓How ACME challenges and Let's Encrypt rate limits work
- ✓When to renew and how to monitor the expiry of the served certificate
- ✓How forwarding headers, HSTS and mixed content affect a Rails application
- ✓When to choose a SAN list or a wildcard certificate
What force_ssl actually does
This application already runs on HTTPS, and three lines in config/environments/production.rb are why:
Read the full lesson free →Curriculum
7 lessonsWhat force_ssl actually does
How assume_ssl, force_ssl and the /up exclusion behave when a proxy terminates TLS before Rails.
Certificates and the chain of trust
What a certificate contains, why servers must send the intermediate, and how to diagnose common certificate errors.
ACME and Let's Encrypt
How ACME automates issuance, the HTTP-01, DNS-01 and TLS-ALPN-01 challenges, and Let's Encrypt rate limits.
Automating renewal
Shrinking certificate lifetimes, renewing at a third of validity, common renewal failures, and monitoring the served expiry date.
Terminating TLS, and what Rails sees
Termination arrangements, forged forwarding headers, the redirect loop, HSTS commitments and mixed content in a Rails application.
Wildcards, multiple domains, and the usual mistakes
SAN lists versus wildcards, certificate transparency, apex and www names, internal services, and recurring certificate mistakes.
Putting it together: HTTPS for this application
Applies the course to this application: Rails config, kamal-proxy behind Cloudflare, preconditions and an expiry check.