What is inside
A certificate answers one question for the browser: "is this server really example.com?" It holds four things, and a certificate authority (CA) signs them. Your browser ships with a list of CAs it trusts, so it can check the signature without asking anyone.
| Field | What it holds | What the browser does with it |
|---|---|---|
| Name | The domain, such as example.com | Compares it with the address you typed |
| Public key | Half of a key pair; the site keeps the other half secret | Uses it to agree on a secret for this visit |
| Issuer | The authority that signed it | Checks the signature against its trusted list |
| Valid until | An expiry date | Shows a warning page if the date has passed |
$ openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \ | openssl x509 -noout -subject -issuer -dates subject=CN = example.com issuer=… (the authority that signed it) notBefore=… notAfter=… (after this date browsers refuse it)
Where you get one
You prove to a CA that you control the domain, and it issues a certificate. The usual proof is a file served from your site or a DNS record. Let's Encrypt does this automatically and for free, which is why most of the web is on https.
Certificates are getting shorter-lived. Let's Encrypt issues them for 90 days today and plans 64 days from 10 February 2027, 45 days from 16 February 2028. A short life limits the damage of a stolen key, and it makes hand-made renewal a bad habit: something must renew the certificate on a schedule, or the site shows a warning on the day it expires.
Do you need one?
You need one when
- Anyone else opens the site. Browsers label plain http pages as not secure.
- There is a form or a login. Passwords and messages must not travel in the open.
- Another service calls you. Telegram, for one, sends webhooks only to https addresses.
You can skip it when
- It runs on
localhost. Traffic never leaves your machine. - It is a private test on your own network. A self-made certificate works, and your browser warns you once.
The lock means the connection is encrypted and the name matches. It does not mean the site is honest: a fake shop can have a valid certificate too.
HTTPS in Uno
A site you publish gets a public https address on uno4.me, free, with nothing to install. A computer: a computer that serves HTTP on port 80 gets a real https address with a valid certificate; Uno handles the encryption, and you buy no domain. Your own domain: to use your own domain you add two records at your registrar: a TXT record that proves you own it and a CNAME to cname.uno4.dev; after the records are visible, Uno issues the certificate by itself; the API reports the state: pending, issuing, active.
Sites: free
A computer with an https address, from $5 a month
Run a site, an API or a bot. Uno puts https in front, so your program only speaks plain HTTP on port 80.
Small
A Telegram bot, a VPN, a small backend
$5/ month
- 1 vCPU · 1 GB
- 15 GB disk
- 25 GB cloud storage
- 5 boosts a month
Plus
Agents that work with your laptop closed
$20/ month
- 4 vCPU · 4 GB
- 40 GB disk
- 100 GB cloud storage
- Uno Work in the cloud
Pro
A product in production, a second MacBook
$70/ month
- 16 vCPU · 16 GB
- 120 GB disk
- 300 GB cloud storage
- Speed of a MacBook Air M4
Max
A team and many agents at once
$200/ month
- 32 vCPU · 48 GB
- 300 GB disk
- 1,024 GB cloud storage
- 5 public IPv4
Add Uno AI to any plan: 40 h of AI work a month on Small, 100 h on Plus, unlimited on Max. Today: GLM-5.3 Flash and MiMo v2.6 Pro. Or sign in with your own Claude or ChatGPT.