Buy

Buy an SSL cert, I'm getting a PositiveSSL Wildcard for 5 years ($39 USD/yr): https://www.ssls.com/
Let them generate the key and CSR, it's easier
Get the domain ownership verification email sent to admin@thighhighs.top and follow the steps to enter the verification code
Wait for domain validation to happen on their backend
Download the archive containing the cert and CA chain bundle

Download and unpack

I swear this changes all the time... okay download the two zip files:

Generated key file
Signed cert

Dump them in the usual spot, ~/Dropbox/archive/2026-10-12_thighhighs.top_SSL_cert_5yr_renewal/downloads/

Unpack the key to the parent dir, it's always STAR.thighhighs.top_key.txt

Unpack the cert files to the parent dir, you only need

STAR.thighhighs.top.crt
STAR.thighhighs.top.ca-bundle

As of 2026-10-26, the new trust path is:

subject: CN=*.thighhighs.top
issuer:  C=US, O=SSL Corporation, CN=SSL.com TLS Issuing RSA CA R1

subject: C=US, O=SSL Corporation, CN=SSL.com TLS Issuing RSA CA R1
issuer:  C=US, O=SSL Corporation, CN=SSL.com TLS RSA Root CA 2022

subject: C=US, O=SSL Corporation, CN=SSL.com TLS RSA Root CA 2022  <-- interestingly this is in the system Trusted Root CAs store
issuer:  C=US, O=SecureTrust Corporation, CN=SecureTrust CA

subject: C=US, O=SecureTrust Corporation, CN=SecureTrust CA  <-- as is this one of course
issuer:  C=US, O=SecureTrust Corporation, CN=SecureTrust CA

Prepare derived files for different consumers

Some apps want the CA separate, some want it included, some don't need it at all, etc etc.

mv STAR.thighhighs.top_key.txt STAR.thighhighs.top.key

cat STAR.thighhighs.top.crt STAR.thighhighs.top.key > combined_leaf_cert_and_key.txt

cat STAR.thighhighs.top.crt STAR.thighhighs.top.ca-bundle > STAR_thighhighs_top.cert-and-chain

# P12 format without cert chain
# We use "unifi" here for historical reason
openssl pkcs12 -export -legacy \
    -inkey STAR.thighhighs.top.key \
    -in STAR.thighhighs.top.crt \
    -out STAR.thighhighs.top_no_chainfiles.p12 \
    -name unifi -password pass:unifi

# P12 format with cert chain included
openssl pkcs12 -export -legacy \
    -chain -untrusted STAR.thighhighs.top.ca-bundle \
    -inkey STAR.thighhighs.top.key \
    -in STAR.thighhighs.top.crt \
    -out STAR.thighhighs.top.p12 \
    -name unifi -password pass:unifi

Install

Revised on 2026-10-25, there's fewer services that need cert maintenance now, thank God.

basti - caddy webhost for gitea and alma repos

Files go in /etc/caddy/certs/

cd /etc/caddy/certs/

# update the files

chmod 0600 STAR_thighhighs_top.key STAR_thighhighs_top.cert-and-chain
chown caddy:caddy STAR_thighhighs_top.key STAR_thighhighs_top.cert-and-chain

systemctl restart caddy.service

nozomi - proxmox hypervisor

Upload the new cert to the Proxmox interface, once per node I guess: https://nozomi.thighhighs.top:8006/#v1:0:=node%2Fnozomi:4:=certificates::::::9

Uses the key, and cert-and-chain.

iowa

Control panel -> Security -> Certificates tab
Add -> Replace an existing cert -> Select the *.thighhighs.top cert
Description = *.thighhighs.top
Select "Import certificate", and set it as the default
Upload the key, leaf cert, and ca-bundle separately

It'll take a moment as it receives and updates the cert, then it takes effect immediately.

fenny

This is extremely similar to the way Synology (iowa) does it:

Open the Settings app, then go to the Certificate Manager tab
Click the Add button
Replace an existing cert
Import your SSL private key and certificate
Upload the key, leaf cert, and ca-bundle separately

printer

The Brother printer needs a P12 format cert as well, but it needs it without the included chainfiles otherwise it says the file is too large.

This year (end of 2025) I found I needed to import the new cert (STAR_thighhighs_top_no_chainfiles.p12), delete the old one, then finally select it as the active cert for HTTPS.

https://printer.thighhighs.top/net/security/certificate/certificate.html

Import Certificate and Private Key
Select the file STAR.thighhighs.top_no_chainfiles.p12
Enter the password unifi and submit it
Delete the old (expiring) cert
Go to the HTTP server settings: https://printer.thighhighs.top/net/net/certificate/http.html
Select the wildcard cert and Submit
Answer Yes to restart immediately

Old install notes

Updated for November 2025, there's some small changes to my environment, and the files that I get from the provider. Notably, the trust root is now "Sectigo Public Server Authentication Root R46" (a completely different chain compared to last year). And although that root is trusted by my browser, the cert bundle actually includes a higher CA that has signed it for trust: USERTrust RSA Certification Authority. That cert is self-signed and included in the bundle. What's also interesting is that last year, the bundle included a CA about that one, being signed by AAA Certificate Services. Anyway it doesn't matter now.

Copy the new key, cert, and chain ("bundle") to the server, probably illustrious, to /etc/ssl using date-based filenames:
```
STAR_thighhighs_top.key.2025
STAR_thighhighs_top.crt.2025
STAR_thighhighs_top.ca-bundle.2025
```
Concatenate the cert and the chain/bundle, in that order, this is a general purpose cert file now (apps that only want the leaf cert will just read the first cert in the file)
```
cat STAR_thighhighs_top.crt.2025 STAR_thighhighs_top.ca-bundle.2025 > STAR_thighhighs_top.crtbundled.2025
```

Generate the .p12 file for things that might need it, one of these will do. I only just figured out how to include the chain in the p12

# no chain in P12
openssl pkcs12 -export -legacy \
    -inkey STAR_thighhighs_top.key.2025 \
        -in STAR_thighhighs_top.crt.2025 \
        -out STAR_thighhighs_top_no_chainfiles.p12.2025 \
        -name unifi -password pass:unifi

# with chain in P12
openssl pkcs12 -export -legacy \
    -chain -untrusted STAR_thighhighs_top.ca-bundle.2025 \
        -inkey STAR_thighhighs_top.key.2025 \
        -in STAR_thighhighs_top.crt.2025 \
        -out STAR_thighhighs_top.p12.2025 \
        -name unifi -password pass:unifi

Update all the symlinks for apps that use certs

ln -sf STAR_thighhighs_top.ca-bundle.2025  STAR_thighhighs_top.ca-bundle
ln -sf STAR_thighhighs_top.crt.2025        STAR_thighhighs_top.crt
ln -sf STAR_thighhighs_top.crtbundled.2025 STAR_thighhighs_top.crtbundled
ln -sf STAR_thighhighs_top.key.2025        STAR_thighhighs_top.key
ln -sf STAR_thighhighs_top.p12.2025        STAR_thighhighs_top.p12

Go fix up configs or restart services that use the cert
- Pihole with lighttpd: servers/calico#TLS_support
- Caddy: systemctl restart caddy
- nginx support
```
    server {
        listen 80;
        listen 443 ssl;

        server_name thighhighs.top ;

        ...

        ssl on;
        ssl_certificate     /etc/ssl/STAR_thighhighs_top.combined.pem;
        ssl_certificate_key /etc/ssl/STAR_thighhighs_top.key;

        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 8.8.8.8 8.8.4.4;

        include /etc/nginx/fragment/gzip;
    }
```
  - Restart nginx, add session caching and whatnot if you want: http://nginx.org/en/docs/http/configuring_https_servers.html#optimization
- Fix up the Unifi controller, these notes are a bit stale as it's not containerised, but it's basically correct: UnifiController#A_real_signed_SSL_cert_for_the_controller
- The Synology NAS uses individual key/cert/chain files; instead of Action-Renew just use Add-Replace; set it as the default system cert
- Update fenny as well, the Asustor Flashstor NAS. Its interface is surprisingly almost identical to Synology: Add, Replace, Import, upload the three files
- The Brother printer needs a P12 format cert as well, but it needs it without the included chainfiles otherwise it says the file is too large
  - This year (end of 2025) I found I needed to import the new cert (STAR_thighhighs_top_no_chainfiles.p12), delete the old one, then finally select it as the active cert for HTTPS in https://printer.thighhighs.top/net/net/certificate/http.html
Test:
- https://ssllabs.com/ssltest/
- https://weakdh.org/sysadmin.html

Improvements

Useful site: https://timtaubert.de/blog/2014/10/deploying-tls-the-hard-way/

Now figured out what to make of...

OCSP stapling

http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling

Exactly which certs need to be where is unclear

HSTS

Should be as easy as adding a header, best to split your http/https blocks in the config and redirect to HTTPS always.