01 / DECISION
When this primitive earns a place
Prefer Full (strict) when the origin presents a valid certificate; make hostname coverage and renewal ownership explicit.
02 / ARCHITECTURE
Build the smallest defensible path
Map edge and origin certificates, confirm hostnames and validity, then enforce HTTPS only after redirect and mixed-content paths are tested.
- 01Name the contract
Prefer Full (strict) when the origin presents a valid certificate; make hostname coverage and renewal ownership explicit.
- 02Add one primitive
Map edge and origin certificates, confirm hostnames and validity, then enforce HTTPS only after redirect and mixed-content paths are tested.
- 03Capture failure evidence
Inspect the public certificate chain, test the origin separately, and verify HTTP-to-HTTPS behavior without exposing private keys.
03 / REPRODUCE
Evidence before confidence
Inspect the public certificate chain, test the origin separately, and verify HTTP-to-HTTPS behavior without exposing private keys.
curl -Iv https://example.com/04 / BOUNDARY
The production boundary
Flexible encryption leaves the origin leg unencrypted and can create redirect loops. HSTS should be enabled only with a tested recovery plan.
05 / FIRST-PARTY SOURCES
Keep first-party sources authoritative
Product behavior, limits, pricing, and availability can change. Re-check these sources before acting.