Free HTTPS for PWA Domains: Why It's Non-Negotiable
Free HTTPS for PWA domains isn't a nice-to-have — without a certificate, the browser won't register a service worker or hand out a push subscription at all. Here's why that matters specifically for arbitrage PWAs, and how to get a certificate issued and renewed without touching it by hand.
Why a PWA Simply Doesn't Work Without HTTPS
A service worker — the backbone of any PWA — only registers in a “secure context,” which in practice means HTTPS everywhere except localhost during development. No service worker means no offline cache, no install prompt, and, more importantly for arbitrage, no push delivery. A plain HTTP domain in a PWA setup just won't run the functionality you need, no matter how good the prelander is.
HTTPS and Web Push: A Hard Dependency
The Web Push API is specified to work over HTTPS only — that's a requirement of the standard itself, not a quirk of one particular browser. A push base collected on an HTTP domain technically can't receive notifications at all, which makes the certificate question blocking, not optional, for the whole push mechanism behind an offer.
Where “Free” HTTPS Actually Comes From
Free certificates come from certificate authorities like Let's Encrypt through the automated ACME protocol: the domain proves ownership (via a DNS record or a file on the server), and in exchange gets issued a short-lived certificate — typically around 90 days. That's not a reliability trade-off — the encryption is identical to paid certificates; the real difference is mostly support and validation type (domain vs. organization).
Auto-Renewal — and Why Manual Issuance Doesn't Scale for Arbitrage
A certificate's short lifespan requires renewal without a human in the loop, or it quietly expires and traffic to the domain suddenly starts hitting a browser warning about an untrusted connection. In arbitrage, where domains rotate often because of bans, manually issuing and renewing a certificate for every new domain is a bottleneck that simply doesn't scale.
Domain Rotation and Certificate Issuance Speed
Rotating a domain — say, after a ban — needs more than fresh DNS pointing at a new domain; it needs a new certificate too, and speed matters here specifically: the faster HTTPS is issued on the new domain, the faster a campaign gets back live. Any delay at this step is pure downtime and ad spend burning with zero offer impressions to show for it.
How This Works Inside APEX
In APEX, certificate issuance and renewal are built directly into domain connection and rotation: add a new domain and the certificate is issued automatically, and renewal happens without buyer involvement before expiry. One-click domain rotation only works as advertised because the certificate step isn't a manual bottleneck sitting in the middle of it.
FAQ
- Can a PWA run without HTTPS, even temporarily?
- No — the browser simply won't register a service worker without HTTPS (aside from localhost for development), and without one there's no install prompt and no push.
- What's the actual difference between a paid and a free certificate?
- The encryption strength is the same; the difference is mostly support, the issuing authority's guarantees, and sometimes validation type (domain vs. organization) — none of which matters much for a standard PWA domain.
- What happens if a certificate isn't renewed in time?
- The browser starts showing an untrusted-connection warning, and part of the PWA's functionality — install, push — stops working until the certificate is reissued.
- Does a buyer need to manually issue a certificate for every new domain in APEX?
- No — issuance and renewal happen automatically whenever a domain is connected or rotated.
- How long does a free Let's Encrypt certificate typically last?
- Around 90 days by default, which is exactly why unattended auto-renewal isn't a convenience — it's a requirement.
Cloaking, anti-bot, push, split tests and your own domains — in one service.
Get started free