Go to https://www.startssl.com

Create an account

After verify the account with email code, go to control panel, to the tab "Validations Wizard", choose "Domain Name Validation" on "Type", click "Continue" and follow the steps.

After that, go to the tab "Certificates Wizard" and on "Certificate Target" choose "Web Server SSL/TSL Certificate" and follow the steps (choose SHA2 on "Secure Hash Algorithm"; set the staging sub-domain as as sub-domain when it asks)

Follow this steps https://www.startssl.com/?app=42

scp <project>.decrypted.key <user>@<host>:/etc/nginx/ssl.key

scp ssl.unified.crt <user>@<host>:/etc/nginx

login on the server

chmod 600 /etc/nginx/ssl.key

cat ssl.key ssl.unified.crt > server.pem

chmod 0600 /etc/nginx/server.pem

On staging and production environment, uncomment the line config.force_ssl = true

Monit and Nginx on deploy are already configured to use ssl =)