The padlock used to cost money and a weekend of file-wrangling. With NPM it is a dropdown, a checkbox and ninety seconds — and it renews itself.
Every proxy host you create deserves HTTPS, and with Let's Encrypt there is no cost excuse left: the certificates are free, trusted by every browser, and NPM does the entire exchange for you. This page explains what actually happens when you click 'request a certificate', what the three switches under it do, and the one requirement — a reachable port 80 — whose absence explains almost every renewal failure you will ever meet.
When you request a certificate, NPM contacts Let's Encrypt and says 'this server controls app.yourdomain.com'. Let's Encrypt proves it the practical way — it asks your server, over the public internet on port 80, to show a one-time token at a special address. Your server shows it, ownership is proven, and the certificate is issued on the spot. This is called the HTTP-01 challenge, and it explains two non-negotiable requirements: DNS must already point at your server, and port 80 must reach NPM from the internet. Fail either one and the request fails — the error is in the setup, never in Let's Encrypt.
Do this only after the plain host already works. HTTPS on a broken host gives you a broken host with a certificate, and twice the places to look for the fault.
Force SSL redirects every http visitor to https automatically — turn it on, always; without it the unencrypted door stays open beside the encrypted one. HTTP/2 Support lets browsers load a page's many files more efficiently over the encrypted connection — on, no downside. HSTS tells browsers 'never speak to this site unencrypted again, for months'. That is genuinely stronger protection, but it is a promise you cannot quickly take back — enable it only once a service is settled and its certificate renewals are proven, not on day one of an experiment.
Let's Encrypt certificates live for 90 days — deliberately short, so that automation does the work and lost keys expire quickly. NPM renews them automatically, typically about a month before expiry, using the same port-80 proof. Renewal failures therefore have boring causes: DNS was changed, the router forwarding was removed, port 80 got blocked by an ISP or a firewall tidy-up. If a certificate ever approaches expiry, check those three before anything exotic. NPM also emails the account address about certificate problems — one more reason the admin email you set at first login should be a real mailbox.
One certificate can cover every subdomain — *.yourdomain.com — but Let's Encrypt will not issue a wildcard from the port-80 proof. NPM supports the alternative DNS challenge: you give it an API token for your DNS provider, it writes a temporary TXT record to prove control, and the wildcard is issued. Worth it once you pass a handful of services; unnecessary ceremony for your first two or three hosts, where one certificate each is simpler to understand and to fix.
In the video you can watch a certificate being issued in real time — including the exact moment the padlock appears. It is faster than reading about it.
▶️ Watch Full VideoYes. They are trusted by all modern browsers and operating systems, and used by hundreds of millions of sites. For a normal website or service, there is no practical difference from a paid certificate.
Almost always one of three things: DNS does not point at your server yet, port 80 does not reach NPM from the internet, or the domain was rate-limited by earlier failed attempts. Fix the first two, wait, and retry.
On a trusted LAN it is optional, and many people skip it internally. The moment a service is reachable from the internet, HTTPS stops being optional — logins and data cross networks you do not control.