The padlock is not decoration. Without HTTPS, browsers stamp your site Not Secure, every password crosses the internet as readable text, and search engines quietly prefer sites that have it. The good news: certificates are free, and for a home-hosted site there are two clean routes to one - this guide walks both.
The hosting setup in the video gets your site onto the internet. This guide finishes the job properly. An unencrypted site is not a small cosmetic flaw: the first time you log into your own site's admin page from a cafe, that password travels exactly as readable as this sentence. HTTPS is the step that turns a working demo into a website you can defend - and since Let's Encrypt arrived, cost is no longer an excuse anyone gets to make.
Two things. Privacy: the conversation between visitor and your PC is encrypted, so logins, forms and pages cannot be read or altered on the way. Identity: the certificate proves the site answering really is the one that owns your name. On a home server this stops being theoretical the moment any login exists - your site's admin page, a family album password, a contact form with personal details. Plain HTTP on the open internet is unfinished work, and browsers now say so to every visitor, in the address bar, in red.
If your site rides a tunnel, this entire topic shrinks to a sentence: the tunnel service terminates HTTPS at its edge with its own managed certificate for your hostname. Issuing, installing and renewing all happen on their side. Your local server can even stay plain HTTP, because the only machine that ever talks to it directly is the tunnel connector on your own PC. For CGNAT homes - where route one's HTTP challenge cannot work - this is usually the practical answer, and it is a large part of why tunnels became the modern default.
An expired certificate is worse than none for one evening: browsers show a full-page warning and most visitors simply leave. So treat renewal as machinery, not memory. Confirm the auto-renewal task exists and has run at least once (check the certificate's dates in the browser - they should show a fresh 90-day window, not the original one ageing). Put a reminder a few days before the first expiry to verify the machine renewed itself. Manual renewal every 90 days is a chore designed to be forgotten - and on a home server, it will be, exactly once, at the worst time.
Watch the video to bring the site online - then return here and give it the padlock it deserves.
▶️ Watch Full VideoPractically, no - public certificates are issued to domain names you control. That is one more reason the Dynamic DNS hostname matters in the home setup: it gives your server a name a certificate can be issued to, even though the address underneath it keeps changing.
By an amount no visitor can feel on any modern PC. The honest speed limit of a home-hosted site is your upload bandwidth, shared across visitors - not the encryption. If the site feels slow, look at the connection, not the padlock.
Renew it immediately - run your ACME client once by hand - then fix the automation that missed it. Usual causes: the renewal task was never scheduled, or DNS validation failed because the DDNS record had drifted at renewal time. Visitors see the warning only until the new certificate is being served.