Panduan Lengkap Implementasi HTTPS untuk Website dari Zero hingga Hero Tahun 2026

<VirtualHost *:443>
    ServerName yourdomain.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile /path/to/certificate.crt
    SSLCertificateKeyFile /path/to/private.key
    SSLCertificateChainFile /path/to/chain.crt

    # Security Headers 2026
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'"
</VirtualHost>

# Redirect HTTP ke HTTPS
<VirtualHost *:80>
    ServerName yourdomain.com
    Redirect permanent / https://yourdomain.com/
</VirtualHost>

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name yourdomain.com www.yourdomain.com;

    root /var/www/html;
    index index.html;

    # SSL Configuration
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    ssl_trusted_certificate /path/to/chain.pem;

    # Modern SSL Configuration 2026
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # Security Headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
}

# Update system packages
sudo apt update && sudo apt upgrade -y

# Install Certbot
sudo apt install certbot python3-certbot-nginx

# Generate SSL certificate
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

# Test auto-renewal
sudo certbot renew --dry-run

# Edit crontab
sudo crontab -e

# Add line untuk auto-renewal
0 12 * * * /usr/bin/certbot renew --quiet

# Generate wildcard certificate dengan DNS challenge
sudo certbot certonly --manual --preferred-challenges dns \
  --email admin@yourdomain.com \
  --server https://acme-v02.api.letsencrypt.org/directory \
  --agree-tos \
  -d "*.yourdomain.com" -d "yourdomain.com"

# Add TXT record ke DNS provider
# _acme-challenge.yourdomain.com -> [generated_value]

server {
    listen 443 ssl http2;
    # ... konfigurasi SSL lainnya

    # HTTP/2 Push untuk critical resources
    http2_push /style.css;
    http2_push /script.js;

    # Server push untuk font files
    location = /font.woff2 {
        http2_push /font.woff2;
        add_header Cache-Control "public, max-age=31536000, immutable";
    }
}

server {
    listen 443 ssl http3;
    listen [::]:443 ssl http3;

    # HTTP/3 specific settings
    quic_retry on;
    quic_gso on;
    quic_host_key /path/to/host.key;

    # Enable Alt-Svc header
    add_header alt-svc 'h3=":443"; ma=86400';
}

<?php
// Generate random nonce untuk setiap request
$nonce = base64_encode(random_bytes(16));
?>

<script nonce="<?php echo $nonce; ?>">
    // Inline JavaScript code
</script>

add_header Content-Security-Policy "
    default-src 'none';
    script-src 'self' 'nonce-<?php echo $nonce; ?>' 'strict-dynamic' https://cdn.trusted.com;
    style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
    font-src 'self' https://fonts.gstatic.com;
    img-src 'self' data: https://images.unsplash.com;
    connect-src 'self' https://api.yourdomain.com;
    frame-ancestors 'none';
    base-uri 'self';
    form-action 'self';
    upgrade-insecure-requests;
" always;

# Script untuk SSL certificate expiry monitoring
#!/bin/bash

domain="yourdomain.com"
expiry_date=$(echo | openssl s_client -servername $domain -connect $domain:443 2>/dev/null | openssl x509 -noout -dates | grep notAfter | cut -d= -f2)

# Convert ke timestamp
expiry_timestamp=$(date -d "$expiry_date" +%s)
current_timestamp=$(date +%s)
days_until_expiry=$(( (expiry_timestamp - current_timestamp) / 86400 ))

# Alert jika certificate akan expired
if [ $days_until_expiry -lt 30 ]; then
    echo "WARNING: SSL certificate for $domain expires in $days_until_expiry days"
    # Send notification ke monitoring system
fi

# Session tickets untuk faster handshake
ssl_session_tickets on;
ssl_session_ticket_key /path/to/ticket.key;
ssl_session_timeout 1d;

# Session cache untuk existing connections
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1h;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

// JavaScript untuk detect mixed content
const checkMixedContent = () => {
  const resources = document.querySelectorAll('img, script, link, iframe');

  resources.forEach(resource => {
    const url = resource.src || resource.href;
    if (url && url.startsWith('http://')) {
      console.warn('Mixed content detected:', url);
      // Auto-fix untuk development
      if (location.protocol === 'https:') {
        const secureUrl = url.replace('http://', 'https://');
        if (resource.src) resource.src = secureUrl;
        if (resource.href) resource.href = secureUrl;
      }
    }
  });
};

checkMixedContent();

# Check certificate chain
openssl s_client -connect yourdomain.com:443 -showcerts

# Verify certificate against intermediate
openssl verify -CAfile intermediate.pem yourdomain.com.crt

# Test certificate configuration
sslyze --regular yourdomain.com:443

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-random'
Permissions-Policy: geolocation=(), microphone=(), camera=()