Configure SSL/TLS for my app. I want HTTPS everywhere, automatic certificate renewal, and no chance of a random certificate expiry surprise a few months after launch. Cover each of these: 1. Certificates: use Let's Encrypt via the platform's built-in integration or a service like Cloudflare that handles certs automatically. Confirm the renewal is automated, not a task on my calendar. Verify renewal has actually run at least once (or force a renewal in staging) so I know the flow works. 2. Enforce HTTPS: every HTTP request should 301 to HTTPS. Verify this by hitting http://mydomain.com with curl and confirming the redirect. Cookies must be set with the Secure flag so they aren't sent over any accidental plaintext connection. 3. HSTS: enable Strict-Transport-Security once you're confident HTTPS is working across every subdomain you actually serve. Start with a modest max-age, then bump to a longer one after a soak. Consider includeSubDomains and preload only when you're sure every subdomain has HTTPS. 4. TLS versions and ciphers: disable TLS 1.0 and 1.1. TLS 1.2 minimum, TLS 1.3 preferred. If the platform lets me configure this, verify it; if not, note what version it uses. 5. Certificate coverage: make sure the cert covers every hostname I actually serve (apex, www, api, staging). A missing SAN is the reason api.mydomain.com returns a browser scary-page while the marketing site is fine. 6. Monitoring: add expiry monitoring (uptime service or a scheduled check) as a belt-and-suspenders for the automatic renewal. Alert me two weeks before expiry so a broken renewal has time to be noticed. Don't add HSTS preload until you're sure everything's on HTTPS forever; it's very hard to undo. The deliverable is HTTPS enforced across every hostname, auto-renewal verified, HSTS on with an appropriate max-age, TLS versions locked down, and an expiry monitor watching your cert.