How to Enable Free SSL (HTTPS) for a Node.js App on Webuzo

You secure a Node.js app on Webuzo by issuing a free Let's Encrypt SSL certificate for your domain and letting OpenLiteSpeed handle HTTPS, while your app runs on local HTTP behind the proxy. This gives you the padlock and encrypted traffic without changing your app's code.

How SSL fits the Webuzo setup

Your Node app speaks plain HTTP on a local port. OpenLiteSpeed sits in front as a reverse proxy and terminates SSL — it presents the certificate to visitors and encrypts the public connection. So SSL is configured at the web-server level, not inside your app.

Step 1: Issue a free certificate

In the Webuzo panel, use the SSL / Let's Encrypt tool to issue a free certificate for your domain (and any subdomains your app uses). Webuzo requests and installs it for you.

Step 2: Ensure the proxy serves HTTPS

Confirm your domain's HTTPS (port 443) traffic is routed through the reverse proxy to your app's local port, so the app is reachable over https://. This is the same proxy setup that serves HTTP, now with the certificate applied.

Step 3: Redirect HTTP to HTTPS

Force all traffic to HTTPS so visitors always use the secure connection — set up a redirect from HTTP to HTTPS at the web-server level.

Step 4: Renewal

Let's Encrypt certificates are short-lived and renew automatically in Webuzo. It is worth confirming auto-renewal is enabled so your certificate never lapses.

Webuzo's SSL menu varies by version; use these as general steps.

Frequently asked questions

Does my Node app need to handle SSL itself?

No — terminate SSL at OpenLiteSpeed and let your app run on local HTTP behind the proxy. This is simpler and keeps certificate management in one place, and it is the standard Webuzo approach.

Is the certificate really free?

Yes — Let's Encrypt certificates are free and Webuzo can issue and auto-renew them. They provide the same encryption and browser trust as paid certificates for standard use.

My app loads on HTTP but not HTTPS.

Make sure the certificate is issued for the domain and that port 443 traffic is proxied to your app's port, just like your HTTP traffic. A missing certificate or an unproxied 443 is the usual cause.