# How to Configure SSL for Open-SEO: Production and Local HTTPS Setup

> Secure your Open-SEO site with SSL. Learn to configure production and local HTTPS setup by deploying a Cloudflare Worker and enabling strict TLS for automatic certificate provisioning.

- Repository: [Every App/open-seo](https://github.com/every-app/open-seo)
- Tags: how-to-guide
- Published: 2026-07-30

---

**To configure SSL for open-seo, deploy the Cloudflare Worker to your custom domain, point a CNAME record to your `workers.dev` endpoint, and enable Full (strict) TLS encryption in the Cloudflare dashboard to automatically provision a Universal SSL certificate.**

Open-SEO by the every-app/open-seo repository runs as a Cloudflare Workers application that handles SSL termination at the edge. While the platform automatically manages certificates for production domains, you must configure routing and encryption settings in the Cloudflare dashboard to activate HTTPS. For local development, you can enable TLS in the Vite configuration to test secure-origin features.

## Deploy the Worker with Wrangler

The first step to enabling SSL is publishing the Worker to Cloudflare's edge network. The entry point is defined in [`src/server.ts`](https://github.com/every-app/open-seo/blob/main/src/server.ts) ([source](https://github.com/every-app/open-seo/blob/main/src/server.ts)), which exports the request handler that processes all incoming API calls. The build process leverages [`vite-plugin-lean-worker-bundle.ts`](https://github.com/every-app/open-seo/blob/main/vite-plugin-lean-worker-bundle.ts) ([source](https://github.com/every-app/open-seo/blob/main/vite-plugin-lean-worker-bundle.ts)) to bundle the Worker for deployment.

Run the following commands from the repository root:

```bash

# Install Wrangler CLI if not already present

npm i -g wrangler

# Build the Worker bundle

npm run build

# Publish to Cloudflare

wrangler publish

```

This deploys your application to a `workers.dev` subdomain, which already has HTTPS enabled by default. However, to use a custom domain with a branded certificate, continue to the DNS configuration steps.

## Attach a Custom Domain via DNS

To serve open-seo on your own domain with SSL, add a custom domain route in the Cloudflare dashboard and create the corresponding DNS record:

1. Navigate to **Workers & Pages** → **Routes & Triggers** → **Custom Domains**.
2. Click **Add Custom Domain** and enter your domain (e.g., `seo.example.com`).
3. Note the target Workers endpoint (typically `<your-worker>.workers.dev`).
4. In your domain's DNS settings, create a **CNAME** record:
   - Type: `CNAME`
   - Name: `seo` (or subdomain)
   - Target: `<your-worker>.workers.dev`
   - TTL: Auto

The DNS propagation triggers Cloudflare to automatically provision a Universal SSL certificate for your domain within approximately 15 minutes.

## Configure SSL/TLS Encryption Settings

Once the custom domain is active, configure the encryption mode to ensure end-to-end security. These settings are managed entirely within the Cloudflare dashboard and do not require changes to the [`worker-configuration.d.ts`](https://github.com/every-app/open-seo/blob/main/worker-configuration.d.ts) ([source](https://github.com/every-app/open-seo/blob/main/worker-configuration.d.ts)) file, which only defines TypeScript types for the Worker environment.

### Recommended Dashboard Configuration

Set the following options in the **SSL/TLS** → **Overview** section of the Cloudflare dashboard:

- **SSL/TLS encryption mode:** Set to **Full (strict)**. This validates the certificate chain between Cloudflare and the Worker edge, ensuring your [`src/server.ts`](https://github.com/every-app/open-seo/blob/main/src/server.ts) handler receives only encrypted traffic.
- **Automatic HTTPS Rewrites:** Enable this to rewrite any `http://` URLs in your HTML responses to `https://` automatically.
- **Always Use HTTPS:** Optional but recommended. This redirects all HTTP requests to HTTPS before they reach the Worker.

These settings leverage Cloudflare's automatic certificate management, so you never need to manually upload certificate files to the repository.

## Enable HTTPS for Local Development

For testing authentication flows or secure-origin APIs locally, you can configure the Vite dev server to use HTTPS.

### Configure Vite for TLS

Modify [`web/vite.config.ts`](https://github.com/every-app/open-seo/blob/main/web/vite.config.ts) ([source](https://github.com/every-app/open-seo/blob/main/web/vite.config.ts)) to include a server HTTPS configuration:

```typescript
// web/vite.config.ts
import { defineConfig } from 'vite';
import fs from 'fs';
import path from 'path';

export default defineConfig({
  // ... existing plugins and config
  server: {
    https: {
      key: fs.readFileSync(path.resolve(__dirname, 'certs/dev.key')),
      cert: fs.readFileSync(path.resolve(__dirname, 'certs/dev.crt')),
    },
    port: 3000,
    strictPort: true,
  },
});

```

### Generate Self-Signed Certificates

Create a self-signed certificate for local testing:

```bash
mkdir -p web/certs
openssl req -x509 -newkey rsa:4096 \
  -keyout web/certs/dev.key \
  -out web/certs/dev.crt \
  -days 365 -nodes \
  -subj "/CN=localhost"

```

Start the development server with `npm run dev`. The application will be available at `https://localhost:3000`, allowing you to verify TLS behavior before deploying to production.

The [`scripts/selfhost-preflight.ts`](https://github.com/every-app/open-seo/blob/main/scripts/selfhost-preflight.ts) ([source](https://github.com/every-app/open-seo/blob/main/scripts/selfhost-preflight.ts)) script includes additional TLS-related validation checks that run during the self-hosting setup process, ensuring your environment meets HTTPS requirements.

## Summary

- **Deploy** the Worker using `wrangler publish` after building with the Vite plugin bundle.
- **Route** traffic by adding a CNAME record from your custom domain to the `workers.dev` endpoint.
- **Secure** the connection by setting Cloudflare's SSL/TLS mode to **Full (strict)** to trigger automatic Universal SSL provisioning.
- **Develop** locally over HTTPS by configuring the `https` key in [`web/vite.config.ts`](https://github.com/every-app/open-seo/blob/main/web/vite.config.ts) with self-signed certificates.
- **Reference** [`src/server.ts`](https://github.com/every-app/open-seo/blob/main/src/server.ts) for the Worker entry point and [`worker-configuration.d.ts`](https://github.com/every-app/open-seo/blob/main/worker-configuration.d.ts) for environment type definitions.

## Frequently Asked Questions

### How long does SSL certificate provisioning take for open-seo custom domains?

Cloudflare typically provisions a Universal SSL certificate within **15 minutes** of adding a custom domain and DNS record. If you do not see a valid certificate after 24 hours, check that your DNS CNAME record points directly to the Workers endpoint and that the proxy status is enabled (orange cloud).

### Do I need to modify any code files to enable SSL in production?

No code changes are required. SSL termination happens at Cloudflare's edge network before traffic reaches the Worker defined in [`src/server.ts`](https://github.com/every-app/open-seo/blob/main/src/server.ts). You only need to configure the domain and SSL/TLS settings in the Cloudflare dashboard.

### Can I use a custom SSL certificate instead of Cloudflare's Universal SSL?

Yes. If your organization requires a specific certificate, upload it to Cloudflare's **Custom SSL** section under SSL/TLS → Edge Certificates. However, for most open-seo deployments, the automatically provisioned Universal SSL provides equivalent security without requiring manual certificate management or repository modifications.

### Why does local development require HTTPS configuration in vite.config.ts?

Modern browsers restrict certain APIs (such as Service Workers, Camera, or secure cookies) to secure origins only. By enabling HTTPS in [`web/vite.config.ts`](https://github.com/every-app/open-seo/blob/main/web/vite.config.ts) during development, you mirror the production SSL environment and ensure your [`src/server.ts`](https://github.com/every-app/open-seo/blob/main/src/server.ts) fetch handlers behave identically to the deployed Cloudflare Worker.