Mengapa HTTPS?

SSL/TLS mengenkripsi komunikasi antara browser dan server. Tanpa HTTPS, data dikirim dalam plain text dan bisa di-intercept (man-in-the-middle attack).

Wajib HTTPS Karena:

• Browser modern menandai HTTP sebagai "Not Secure"
• SEO: Google memprioritaskan situs HTTPS
• Diperlukan untuk HTTP/2, Service Worker, dan banyak API modern
• Melindungi password, cookie, dan data sensitif

Let's Encrypt & Certbot

Let's Encrypt menyediakan sertifikat SSL gratis. Certbot adalah tool untuk otomasi pengambilan dan renewal sertifikat.

# Install Certbot
sudo apt install certbot python3-certbot-nginx

# Dapatkan sertifikat (otomatis konfigurasi Nginx)
sudo certbot --nginx -d myapp.com -d www.myapp.com

# Otomatis menambahkan ke Nginx:
# listen 443 ssl;
# ssl_certificate /etc/letsencrypt/live/myapp.com/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/myapp.com/privkey.pem;

# Test renewal
sudo certbot renew --dry-run

# Certbot otomatis buat cron/systemd timer untuk renewal

Redirect HTTP ke HTTPS

server {
    listen 80;
    server_name myapp.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name myapp.com;

    ssl_certificate /etc/letsencrypt/live/myapp.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/myapp.com/privkey.pem;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000" always;

    location / {
        proxy_pass http://localhost:3000;
    }
}