How to Configure SSL for Laravel in 2026: A Complete Guide

How to Configure SSL for Laravel in 2026 is no longer a "nice to have" checkbox you tick after launch. Browsers now flag every non-HTTPS form as insecure, payment processors reject plain-HTTP integrations, and Laravel's own request layer assumes a trusted proxy upstream. This guide walks through the entire process: from certificate selection to server config to Laravel-level enforcement, with real commands, real tradeoffs, and persona-matched recommendations at the end.

Overview & Quick Answer

What is SSL/TLS in Laravel?

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) encrypt the traffic between a visitor's browser and your Laravel application. In the Laravel context, SSL is not a Laravel-native concept. It lives one layer below: in Nginx, Apache, Caddy, or a load balancer. Laravel's job is to recognize that the connection is secure, force HTTPS redirects, and serve only safe content.

Definition: SSL/TLS is a cryptographic protocol that encrypts HTTP traffic into HTTPS. For Laravel, it is the trust contract between your server, your certificate authority, and the visitor's browser.

Why SSL matters for Laravel apps

Laravel handles session cookies, CSRF tokens, login credentials, and frequently, payment data. Without SSL, all of that moves across the wire as plain text. The framework includes built-in defenses against SQL injection, CSRF, and XSS (HostingAdvice notes Laravel's security baseline), but those defenses assume the transport layer is already encrypted. Strip out SSL, and Laravel's session cookies become trivially stealable.

Quick answer to "How to Configure SSL for Laravel"

Three steps, in order: (1) obtain a certificate from Let's Encrypt, a commercial CA, or a self-signed source for dev; (2) install it on your web server (Nginx, Apache, or Caddy) and redirect port 80 to 443; (3) tell Laravel to enforce HTTPS via the URL::forceScheme('https') call inside AppServiceProvider or the TrustProxies middleware. The rest of this guide expands each step with real commands and edge cases.

Why It Matters in 2026: Trends & Compliance

PCI DSS & GDPR updates

PCI DSS 4.0, fully enforced since March 2025, requires TLS 1.2 or higher for any card data in transit. GDPR enforcement in the EU has tightened around the same principle: unencrypted personal data is treated as a "lack of appropriate technical measures" in a breach investigation. If your Laravel app touches EU users, SSL is a compliance line item, not a feature.

Cloud-native deployments

Most Laravel apps in 2026 ship through Laravel Forge, Vapor, or a Kubernetes pipeline. Each path terminates SSL differently. Forge and Vapor automate certificate renewal through Let's Encrypt. Kubernetes deployments typically push SSL termination to an ingress controller (Nginx Ingress, Traefik, or AWS ALB). Knowing where SSL ends in your stack is the first step to configuring it correctly.

Browser security warnings

Chrome, Firefox, and Safari have all deprecated the "neutral" padlock. An HTTP-only site now shows "Not Secure" in the address bar by default. For an e-commerce Laravel storefront, that single label measurably reduces checkout conversion. For B2B apps, it disqualifies you from enterprise procurement before a single technical question is asked.

Prerequisites & Requirements

Laravel version & PHP compatibility

Laravel 11 and Laravel 12 (the current LTS-grade branches) both support PHP 8.2 through 8.4. For SSL itself, the PHP version does not matter. What matters is that your PHP build has the OpenSSL extension enabled, which is the default on every modern stack. Confirm with php -m | grep openssl before continuing.

Server environment (Nginx, Apache, Caddy)

Pick the server you already run. Nginx is the most common Laravel choice in 2026. Apache still ships on many shared hosts, including Hostinger's Business and above plans. Caddy is the newcomer, with automatic HTTPS baked in via its own CA client. Each server has a different config syntax, but the goal is the same: a 443 listener that serves your cert chain and a 301 redirect from 80 to 443.

Domain & DNS ready

Your A or AAAA record must resolve to your server's public IP before any CA will issue a certificate. Let's Encrypt specifically requires the domain to point at the requesting server for the HTTP-01 challenge. Plan at least 24 hours for DNS propagation if you just changed nameservers.

Access (SSH, FTP, Hosting panel)

For a VPS or dedicated server, you need root or sudo SSH access. For shared hosting, you are limited to whatever the panel exposes, usually a one-click Let's Encrypt toggle and a file manager. Hostinger's panel, for example, exposes SSL through the security tab, but the underlying .htaccess edits are yours to manage.

Choosing a Certificate Provider

Free vs paid certificates

Let's Encrypt issues free DV (domain validation) certificates that are trusted by every major browser. For 95% of Laravel apps, that is enough. Paid certificates from DigiCert, Sectigo, or GlobalSign add OV (organization validation) or EV (extended validation), which display the company name in older browser UIs. In 2026, most browsers have dropped the EV green bar treatment, so the visible difference is minimal. The remaining reason to pay is warranty coverage and dedicated support.

Let's Encrypt automation

Certbot is the de facto client, and the EFF maintains it actively. If you use Laravel Forge, certificate management is fully automated. If you roll your own VPS, run Certbot with the Nginx or Apache plugin and a systemd timer or cron job. The 90-day validity is intentional; short lifetimes limit the blast radius of a compromised key.

Commercial CA options

Pick a paid CA when you need wildcard or multi-domain SAN certificates at scale, or when your procurement team requires a specific vendor for compliance. Pricing ranges from $40/year for a basic DV cert to $300+/year for an enterprise wildcard.

Self-signed certificates for dev

Local Laravel development should never hit a public CA. Generate a self-signed cert with OpenSSL, trust it in your OS keychain, and move on. Browsers will warn, but on localhost that is expected and harmless. Some teams also generate a catch-all *.invalid certificate to handle unknown dev domains on shared servers, a trick Laravel News documents for old Forge servers.

Generating & Installing the Certificate (Core Steps)

Using Certbot on Ubuntu

On a fresh Ubuntu 22.04 or 24.04 box with Nginx, the install is three commands:

sudo apt update
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot edits your Nginx config in place, adds the 301 redirect, and reloads the server. Verify the timer is active with sudo systemctl status certbot.timer so renewals happen automatically.

Manual OpenSSL generation

For shared hosting or custom pipelines, generate a CSR and private key by hand:

openssl req -new -newkey rsa:2048 -nodes \
 -keyout /etc/nginx/ssl/yourdomain.key \
 -out /etc/nginx/ssl/yourdomain.csr

Submit the CSR to your CA, download the issued cert and the chain bundle, and place them in /etc/nginx/ssl/. The mkdir -p /etc/nginx/ssl/cat pattern from the Laravel News catch-all guide is a clean way to organize per-site folders.

Uploading cert files via FTP

On shared hosting, you do not get shell access. Upload the .crt, .ca-bundle, and .key files via FTP into a folder outside public_html, then paste their absolute paths into the hosting panel's SSL field. Hostinger's panel, for example, accepts these through a guided form and writes the equivalent Nginx config for you.

Configuring Nginx block

Once the files are in place, your Nginx server block needs three changes. Point to the cert and key, add a 301 redirect from port 80, and force modern TLS protocols:

server {
 listen 443 ssl http2;
 server_name yourdomain.com www.yourdomain.com;
 root /var/www/yourdomain/public;

 ssl_certificate /etc/nginx/ssl/yourdomain/fullchain.pem;
 ssl_certificate_key /etc/nginx/ssl/yourdomain/privkey.pem;
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers HIGH:!aNULL:!MD5;

 index index.php;
 location / { try_files $uri $uri/ /index.php?$query_string; }
 location ~ \.php$ {
 fastcgi_pass unix:/run/php/php8.3-fpm.sock;
 fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
 include fastcgi_params;
 }
}

server {
 listen 80;
 server_name yourdomain.com www.yourdomain.com;
 return 301 https://$host$request_uri;
}

Run sudo nginx -t to validate, then sudo systemctl reload nginx to apply.

Configuring Laravel to Use HTTPS

Updating .env variables

Set APP_URL=https://yourdomain.com in your .env. Without this, Laravel generates http:// URLs in emails, password reset links, and route helpers, which then break or trigger mixed-content warnings. As the Hostinger Artisan command reference points out, environment variables are the source of truth for these URLs.

Force HTTPS middleware

Inside app/Providers/AppServiceProvider.php, add the canonical scheme call inside boot():

use Illuminate\Support\Facades\URL;

public function boot(): void
{
 if ($this->app->environment('production')) {
 URL::forceScheme('https');
 }
}

For multi-environment support, swap production for an APP_ENV check or a custom env flag like FORCE_HTTPS.

Redirects in routes/web.php

For projects without the AppServiceProvider hook, add a global route group:

use Illuminate\Support\Facades\Route;

Route::redirect('/', '/home');

if (app()->environment('production')) {
 \Illuminate\Support\Facades\Redirect::setIntendedUrlFrom_secure();
}

More commonly, a middleware that checks $request->secure() and returns a 301 handles legacy paths that bypass the server-level redirect.

Handling mixed content

If your Laravel app still loads an http:// image, font, or script after the redirect is in place, browsers will block it. Audit your Blade templates for hardcoded http:// URLs, especially in <img src>, <a href>, and asset helpers. The asset() and mixed_asset() helpers respect APP_URL automatically, so prefer those.

Real-World Tradeoffs & Performance

SSL handshake overhead

The TLS handshake adds 1 to 2 round trips before the first byte of HTTP traffic. On a fast network, that is roughly 100ms of latency. With TLS 1.3 and session resumption, you cut that to a single round trip. Modern CPUs handle the AES-NI crypto work essentially for free, so CPU is rarely the bottleneck.

HTTP/2 benefits

Running HTTPS unlocks HTTP/2 in every major browser, which multiplexes requests over a single connection. For a Laravel app loading 30+ frontend assets through Vite, HTTP/2 alone produces a 20-40% page-load improvement. As the Laravel + frontend pipeline reference notes, every modern asset pipeline benefits from this.

Load balancer termination

On AWS, GCP, or a Kubernetes cluster, terminate SSL at the load balancer and serve plain HTTP to your Laravel pods. This centralizes cert management and lets you rotate certs without redeploying. The cost is that $request->secure() returns false inside Laravel. Fix this by setting TrustProxies in app/Http/Middleware and adding the LB's IP range to the proxy list.

Cloudflare SSL modes

Cloudflare offers four SSL modes: Off, Flexible, Full, and Full (Strict). Flexible encrypts visitor-to-Cloudflare but not Cloudflare-to-origin, which is a security hole. Full encrypts both hops but accepts self-signed certs at the origin. Full (Strict) requires a valid CA-issued cert. For production Laravel apps, Full (Strict) is the only acceptable choice.

Pros, Cons & Best Practices

Pros of proper SSL setup

A correctly configured SSL layer gives you browser trust, PCI/GDPR compliance, HTTP/2 performance gains, and SEO ranking preference. Google has used HTTPS as a ranking signal since 2014 and has steadily increased its weight.

Cons / pitfalls

Mixed content warnings are the most common regression. Certificate renewal failures (often caused by rate limits or DNS changes) can take a site offline. Wildcard certs complicate renewal automation. And a misconfigured TrustProxies can leak real client IPs into your logs, a compliance problem in itself.

Security hardening checklist

Enable HSTS with Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Disable TLS 1.0 and 1.1. Use strong cipher suites only. Set session.cookie_secure and session.cookie_httponly in config/session.php. Rotate keys on a schedule, even if your CA's validity window is 90 days.

Monitoring & renewal

Set up certificate expiration alerts at least 14 days before expiry. Uptime monitoring tools like UptimeRobot, Better Uptime, or a simple cron job that parses openssl s_client output will catch most failures. If you use Let's Encrypt, the cert has a 30-day renewal safety net if you screw up.

Common Mistakes & Troubleshooting

404 after SSL redirect

Symptom: visitors hit HTTPS and get a 404, but HTTP works fine. Cause: the document root or try_files directive is wrong in the 443 block. Fix: copy the root, index, and location rules from the original 80 block to the 443 block, then re-test.

Mixed content errors

Symptom: the padlock shows with a warning, or pages are blank. Cause: hardcoded http:// URLs in templates or third-party widgets. Fix: run a project-wide grep for http:// and replace with protocol-relative // or full https:// URLs.

Certificate chain problems

Symptom: SSL Labs gives you a B grade and some clients refuse the cert. Cause: missing intermediate certificates. Fix: use the full chain file (fullchain.pem) instead of the leaf cert alone, and verify with openssl s_client -connect yourdomain.com:443 -showcerts.

Caching & CDN issues

Symptom: after enabling SSL, the site loads with old assets. Cause: Cloudflare or another CDN is caching a redirect to HTTP. Fix: purge the CDN cache and set the SSL mode to Full (Strict) before re-enabling.

Who Is This Best For? (Persona Table)