How to Configure SSL for Open-SEO: Production and Local HTTPS Setup

To configure SSL for open-seo, deploy the Cloudflare Worker to your custom domain, point a CNAME record to your workers.dev endpoint, and enable Full (strict) TLS encryption in the Cloudflare dashboard to automatically provision a Universal SSL certificate.

Open-SEO by the every-app/open-seo repository runs as a Cloudflare Workers application that handles SSL termination at the edge. While the platform automatically manages certificates for production domains, you must configure routing and encryption settings in the Cloudflare dashboard to activate HTTPS. For local development, you can enable TLS in the Vite configuration to test secure-origin features.

Deploy the Worker with Wrangler

The first step to enabling SSL is publishing the Worker to Cloudflare's edge network. The entry point is defined in src/server.ts (source), which exports the request handler that processes all incoming API calls. The build process leverages vite-plugin-lean-worker-bundle.ts (source) to bundle the Worker for deployment.

Run the following commands from the repository root:

# Install Wrangler CLI if not already present

npm i -g wrangler

# Build the Worker bundle

npm run build

# Publish to Cloudflare

wrangler publish

This deploys your application to a workers.dev subdomain, which already has HTTPS enabled by default. However, to use a custom domain with a branded certificate, continue to the DNS configuration steps.

Attach a Custom Domain via DNS

To serve open-seo on your own domain with SSL, add a custom domain route in the Cloudflare dashboard and create the corresponding DNS record:

1. Navigate to Workers & Pages → Routes & Triggers → Custom Domains.
2. Click Add Custom Domain and enter your domain (e.g., seo.example.com).
3. Note the target Workers endpoint (typically <your-worker>.workers.dev).
4. In your domain's DNS settings, create a CNAME record:
   • Type: CNAME
   • Name: seo (or subdomain)
   • Target: <your-worker>.workers.dev
   • TTL: Auto

The DNS propagation triggers Cloudflare to automatically provision a Universal SSL certificate for your domain within approximately 15 minutes.

Configure SSL/TLS Encryption Settings

Once the custom domain is active, configure the encryption mode to ensure end-to-end security. These settings are managed entirely within the Cloudflare dashboard and do not require changes to the worker-configuration.d.ts (source) file, which only defines TypeScript types for the Worker environment.

Recommended Dashboard Configuration

Set the following options in the SSL/TLS → Overview section of the Cloudflare dashboard:

• SSL/TLS encryption mode: Set to Full (strict). This validates the certificate chain between Cloudflare and the Worker edge, ensuring your src/server.ts handler receives only encrypted traffic.
• Automatic HTTPS Rewrites: Enable this to rewrite any http:// URLs in your HTML responses to https:// automatically.
• Always Use HTTPS: Optional but recommended. This redirects all HTTP requests to HTTPS before they reach the Worker.

These settings leverage Cloudflare's automatic certificate management, so you never need to manually upload certificate files to the repository.

Enable HTTPS for Local Development

For testing authentication flows or secure-origin APIs locally, you can configure the Vite dev server to use HTTPS.

Configure Vite for TLS

Modify web/vite.config.ts (source) to include a server HTTPS configuration:

// web/vite.config.ts
import { defineConfig } from 'vite';
import fs from 'fs';
import path from 'path';

export default defineConfig({
  // ... existing plugins and config
  server: {
    https: {
      key: fs.readFileSync(path.resolve(__dirname, 'certs/dev.key')),
      cert: fs.readFileSync(path.resolve(__dirname, 'certs/dev.crt')),
    },
    port: 3000,
    strictPort: true,
  },
});

Generate Self-Signed Certificates

Create a self-signed certificate for local testing:

mkdir -p web/certs
openssl req -x509 -newkey rsa:4096 \
  -keyout web/certs/dev.key \
  -out web/certs/dev.crt \
  -days 365 -nodes \
  -subj "/CN=localhost"

Start the development server with npm run dev. The application will be available at https://localhost:3000, allowing you to verify TLS behavior before deploying to production.

The scripts/selfhost-preflight.ts (source) script includes additional TLS-related validation checks that run during the self-hosting setup process, ensuring your environment meets HTTPS requirements.

Summary

• Deploy the Worker using wrangler publish after building with the Vite plugin bundle.
• Route traffic by adding a CNAME record from your custom domain to the workers.dev endpoint.
• Secure the connection by setting Cloudflare's SSL/TLS mode to Full (strict) to trigger automatic Universal SSL provisioning.
• Develop locally over HTTPS by configuring the https key in web/vite.config.ts with self-signed certificates.
• Reference src/server.ts for the Worker entry point and worker-configuration.d.ts for environment type definitions.

Frequently Asked Questions

How long does SSL certificate provisioning take for open-seo custom domains?

Cloudflare typically provisions a Universal SSL certificate within 15 minutes of adding a custom domain and DNS record. If you do not see a valid certificate after 24 hours, check that your DNS CNAME record points directly to the Workers endpoint and that the proxy status is enabled (orange cloud).

Do I need to modify any code files to enable SSL in production?

No code changes are required. SSL termination happens at Cloudflare's edge network before traffic reaches the Worker defined in src/server.ts. You only need to configure the domain and SSL/TLS settings in the Cloudflare dashboard.

Can I use a custom SSL certificate instead of Cloudflare's Universal SSL?

Yes. If your organization requires a specific certificate, upload it to Cloudflare's Custom SSL section under SSL/TLS → Edge Certificates. However, for most open-seo deployments, the automatically provisioned Universal SSL provides equivalent security without requiring manual certificate management or repository modifications.

Why does local development require HTTPS configuration in vite.config.ts?

Modern browsers restrict certain APIs (such as Service Workers, Camera, or secure cookies) to secure origins only. By enabling HTTPS in web/vite.config.ts during development, you mirror the production SSL environment and ensure your src/server.ts fetch handlers behave identically to the deployed Cloudflare Worker.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}