SSL & HTTPS

surge.sh subdomains

Every project on a surge.sh subdomain is served over HTTPS automatically, covered by Surge's certificate. There is nothing to configure.

Custom domains

Custom domains get free managed certificates, provisioned automatically. Once your domain points at Surge, the platform obtains a certificate from a trusted CA, installs it across every edge node, and renews it before expiry—no command to run. While that's happening the domain reports securing; when every edge is serving it, live:

surge example.com debug status

Inspect the certificate any time with surge example.com debug certs, or check it node-by-node with surge example.com debug audit. Details of the commands are in the CLI SSL docs.

Forcing HTTPS

Having a certificate makes your project available over HTTPS; forcing HTTPS also redirects every plain-HTTP request. Publish with the protocol on the domain:

surge ./dist https://example.com

From then on, http://example.com/… answers with a redirect to the https:// URL. This is the right setting for almost every project—browsers and search engines both favor it. The choice sticks with the project across subsequent publishes.

Bringing your own certificate

On a paid plan, you can install a certificate you already own—say a wildcard or organization-validated cert—by uploading a PEM bundle:

surge example.com ssl --pem ./bundle.pem

The bundle should contain the certificate, any intermediates, and the private key. Surge validates it before applying.