TLS certificate / TLS termination
The file that earns your site the padlock, plus the question of which machine actually decrypts the traffic: the edge or your server.
See it
What it is
A TLS certificate is a signed file proving that whoever answers for 'yoursite.com' really controls that name. The browser checks the signature against a trusted authority, and you get the padlock. Everyone still says 'SSL cert' out of habit, but SSL itself is obsolete: its last version, SSL 3.0, was deprecated in 2015, and modern HTTPS runs on TLS 1.2 or 1.3. Let's Encrypt made certificates free and automatic, which is why most hosts now issue and renew one for you the moment your DNS points at them.
TLS termination is the answer to 'where does the encryption stop?' Usually at the edge: your CDN or load balancer decrypts the request, which is what lets it cache and rewrite things, and then makes its own request to your origin. That second hop is not private just because it is yours. It often crosses public infrastructure, so it should carry its own TLS rather than being left in plaintext on the assumption that it is an internal network. Keeping it encrypted the whole way is end-to-end TLS, or 'full strict' mode, and it means the origin needs a valid certificate of its own.
Traps worth knowing: a cert covers exact names, and a wildcard (*.yoursite.com) covers one level only, so 'a.b.yoursite.com' fails. Issuance needs a working DNS record first, so brand new domains often show a scary warning for a few minutes. And mixed content (an http:// image on an https:// page) will strip your padlock even though the cert is perfect.
Ask AI for it
Inspect this project's hosting setup first, then set up HTTPS on the path that setup actually supports. If the platform issues managed certificates for custom domains, use that: add the domain, add its verification records, and do not hand-roll anything. If it does not, configure ACME (Let's Encrypt) on the reverse proxy instead, and use DNS-01 validation for any wildcard certificate, since HTTP-01 cannot issue one. Cover the apex and www. Keep TLS on the edge-to-origin hop as well (full strict, with a valid or provider-issued origin certificate) rather than treating that hop as private. Force a 301 from http to https, enable HSTS starting at a short max-age before committing to a long one, and require TLS 1.2 as the minimum. Then audit the codebase for mixed-content URLs and hardcoded http:// links, and tell me how renewal is automated on the path you chose and what breaks it.