🎯 Who This Tutorial Is For
Developers experiencing browser SSL certificate errors, redirection loops, or warning padlocks on their websites.
📋 Prerequisites
- ✓Ubuntu VPS or web hosting with root/cPanel access
- ✓Active domain pointed to the server
🚀 What You Will Learn & Build
- ▸How TLS certificates secure web traffic
- ▸Automating free certificates with Certbot
- ▸Fixing Cloudflare 'Flexible' redirect loops
- ▸Finding and fixing mixed content (HTTP resources on HTTPS page)
1
1. Generating SSL with Certbot for Nginx/Apache
Run Certbot to automatically issue and install certificates:
Terminal
# Install certbot
sudo apt install -y certbot python3-certbot-nginx
# Obtain certificate and configure Nginx automatically
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
# Verify renewal timer
sudo systemctl status certbot.timer2
2. Fixing the Infamous 'ERR_TOO_MANY_REDIRECTS' Cloudflare Loop
If your site goes into an infinite redirect loop when using Cloudflare:
- **Cause:** Cloudflare SSL setting is set to **Flexible**. Cloudflare talks to your server over unencrypted HTTP (port 80). Your server responds with an HTTP 301 redirect to HTTPS. Cloudflare gets the redirect, converts it, and asks your server over HTTP again in an infinite loop!
- **Fix:** Change your Cloudflare SSL/TLS encryption mode to **Full (Strict)**.
✨ Expected Output & Verification
Visiting your website displays a secure lock icon in modern browsers with a valid certificate issued by Let's Encrypt or Cloudflare.
🧪 How to Test the Implementation
- 1Check certificate status via Qualys SSL Labs: https://www.ssllabs.com/ssltest/
⚠️ Common Errors & How to Fix Them
❌Mixed Content Warning
Root Cause: HTML page served via HTTPS, but loading images or scripts via http:// URLs.
Fix: Update all asset links to relative paths or https://.
🛡️ Security Considerations & Best Practices
- !Enable HTTP Strict Transport Security (HSTS) headers to force browsers to always use HTTPS.
❓ Frequently Asked Questions (FAQ)
Yes, they expire every 90 days, but Certbot installs a systemd timer that renews them automatically before expiration.
📌 Summary of Key Takeaways
- ✓Always set Cloudflare SSL mode to Full (Strict).
- ✓Certbot automates free Let's Encrypt SSL on Linux.
Official References & Further Reading
- 🔗Certbot Official Instructions— Official EFF Certbot configuration wizard.
MN
Written by Manoj Neupane
AuthorSoftware developer and programming instructor, Nepal
Building software systems and SaaS platforms with Laravel, Next.js, and Node.js. Passionate about helping students and developers in Nepal master practical, real-world development skills.
Related Tutorials
View all tutorials →DevOps & Tools