Add Free SSL / HTTPS to a Node.js App

The simplest and safest way to give a Node.js app HTTPS is to let the web server in front of it handle SSL. Your app keeps talking plain HTTP on localhost while visitors get a valid certificate. This guide covers cPanel hosting and a VPS.

Before you start

A domain whose A record points to your server.
On a VPS: the app already reachable through a reverse proxy. See Node.js reverse proxy.
Ports 80 and 443 open in the firewall (UFW firewall guide).

On cPanel hosting

MdmHost cPanel accounts include free AutoSSL. Apps created in Setup Node.js App are served through the domain's normal virtual host, so the domain's certificate covers them automatically.

Open cPanel → Security → SSL/TLS Status.
Check that your domain shows a valid certificate. If not, tick it and click Run AutoSSL.
Force HTTPS in cPanel → Domains → Domains by switching on Force HTTPS Redirect.

On a VPS with Nginx

Install Certbot:

sudo apt install -y certbot python3-certbot-nginx

Request the certificate; Certbot edits your server block and adds the redirect:
```
sudo certbot --nginx -d example.com -d www.example.com --redirect
```
Test renewal:
```
sudo certbot renew --dry-run
```

More options: Let's Encrypt SSL on Nginx.

On a VPS with Apache

sudo apt install -y certbot python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com --redirect

See Let's Encrypt with Certbot on Apache.

Tell the app it is behind HTTPS

The proxy sends X-Forwarded-Proto: https. Make sure Nginx passes it (proxy_set_header X-Forwarded-Proto $scheme;) and tell your framework to trust it. In Express:

app.set('trust proxy', 1);

Without this, secure cookies are not set and apps that redirect to HTTPS can loop forever.

Can Node.js serve SSL itself?

Yes, with the https module, but you then need root for port 443, must reload certificates on renewal and handle HTTP redirects yourself. Use a proxy unless you have a specific reason not to.

Check that it works

curl -I https://example.com

You should see a 200 status and no certificate warnings. curl -I http://example.com should return a 301 to HTTPS.

Troubleshooting

Certbot challenge fails — DNS is not pointing to the server yet, or port 80 is blocked.
ERR_TOO_MANY_REDIRECTS — add trust proxy, or remove a duplicate redirect in the app.
Mixed content warnings — hard-coded http:// URLs in your app; switch them to relative or HTTPS URLs.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket