SSL Certificates

Every project on Surge is served over HTTPS. surge.sh subdomains are covered the moment they're published, and custom domains are secured automatically: once the domain points at Surge, the platform provisions a certificate from a trusted authority, installs it across the CDN, and renews it before expiry. There is no certificate step in the normal flow—publish, point DNS, done.

The commands below are for watching that process, nudging it, and the one case where you bring your own certificate.

Watching a domain go secure

surge example.com debug status

A custom domain moves through three states: waiting on dns (the domain isn't pointing at Surge yet—the records to add are printed), securing (DNS is right and Surge is provisioning the certificate), and live (serving, verified edge by edge). Publishing reports the same states, so you rarely need to ask separately.

Forcing HTTPS

A certificate makes your project available over HTTPS. To also redirect all plain-HTTP traffic, publish with an explicit protocol on the domain:

surge ./dist https://example.com

The protocol is remembered as project configuration—subsequent publishes keep the behavior. (Publishing to http://example.com does the reverse and pins the project to HTTP.)

Inspecting certificates

surge example.com debug certs

Prints every certificate installed for the domain—subject, issuer, alternate names, expiry, and whether auto-renewal is on. To check certificate state on each individual edge node (useful when diagnosing propagation), see debug audit.

Provisioning manually

surge example.com debug encrypt

debug encrypt asks the platform to provision the domain's managed certificate right now, streaming progress as it goes. Since certificates are provisioned and renewed automatically, you shouldn't need it day to day—it's the lever for unusual situations, like re-securing a domain after DNS was broken for a long stretch.

Bringing your own certificate

If you have a certificate already—an organization-validated or wildcard cert, say—upload it as a PEM bundle containing the certificate, any intermediates, and the private key:

surge example.com ssl --pem ./example.com.pem

The bundle is validated before it's applied; an invalid PEM is rejected with an explanation. Custom certificates require a paid plan.