SSL Certificates

Every project on Surge is served over HTTPS, and custom domains get managed certificates automatically—there is no certificate step in the normal flow. How that works and forcing HTTPS are covered in SSL & HTTPS.

This page covers the commands for watching that process and nudging it.

Watching a domain go secure

surge example.com status

Reports waiting on dns, securing, or live (and ready for a new account's domains awaiting email verification)—see Checking the status. Publishing reports the same states, so you rarely need to ask separately.

Forcing HTTPS

surge ./dist example.com --force https     # at publish
surge example.com config --force https     # or as configuration, no publish

The setting sticks across publishes; surge example.com config --force null clears it. See Forcing HTTPS.

Inspecting certificates

surge example.com debug certs

Prints every certificate installed for the domain—subject, issuer, alternate names, expiry, and whether auto-renewal is on. To check certificate state on each individual edge node (useful when diagnosing propagation), see debug audit.

Provisioning manually

surge example.com debug encrypt

debug encrypt asks the platform to provision the domain's managed certificate right now, streaming progress as it goes. Since certificates are provisioned and renewed automatically, you shouldn't need it day to day—it's the lever for unusual situations, like re-securing a domain after DNS was broken for a long stretch.

This page as markdown · every page in llms-full.txt