A domain and a secure connection for your project

Why a learning project needs this

The link becomes shareable. A short address reads very differently from a long generated subdomain on a free platform.

The browser stops frightening visitors. Without a secure connection a warning appears and people leave without looking.

You learn how it works. Questions about domains and certificates come up constantly at work.

It's cheap: a domain in an inexpensive zone costs a few hundred roubles a year, and the certificate is free.

Choosing a domain

Short and pronounceable. Something you could dictate over the phone.

Without hyphens and digits where possible: people lose them when typing.

The zone. Any inexpensive one suits a learning project. Note only that cheap zones contain a lot of junk, and reputation systems sometimes treat them warily.

Setting it up

1. Buy the domain from any registrar.

2. Point it at your server. In the domain settings create an A record pointing to your server's numeric address. For the www variant, a second identical record or an alias.

3. Wait. Changes propagate from minutes to hours. To check where the domain currently points:

nslookup your-domain.com

4. Check the site opens at the domain over an insecure connection.

The certificate

Free certificates are issued automatically, last three months, and renew themselves.

The usual procedure: install a helper tool, it verifies the domain really is yours, obtains the certificate and configures the web server. Renewal then happens on a schedule without your involvement.

Check two things afterwards:

• The site opens over the secure address and the browser doesn't complain.
• Renewal is configured. In three months the certificate expires, and if renewal isn't working the site stops opening at the worst possible moment.

What else to configure

Redirect to the secure connection. So that the insecure address forwards automatically.

Choose a canonical address. Decide with or without www and redirect one to the other. The same site at two addresses is bad for visitors and for search engines.

Disable outdated protocol versions. Old encryption versions are insecure and should be switched off. Any free analyser will check this.

Common problems

The domain doesn't open. Most likely the change hasn't propagated. Wait and check where it points.

The certificate won't issue. Usually because the domain doesn't yet point at the server, or the verification port is closed by the firewall.

Works without www but not with it. A missing second record, or both addresses weren't included when the certificate was issued.

Everything broke after three months. Renewal wasn't configured. Check the scheduled task.

About email

If you plan to send mail from the domain, configure the records that authorise sending. Without them your messages will land in spam almost without fail.