The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →To configure HTTPS and subdomains on Apache for Ubuntu, point every hostname at the server in DNS, create a name-based Apache VirtualHost for each site, allow ports 80 and 443, then use Certbot to obtain and install a certificate covering all required names. Certbot can configure TLS and reload Apache automatically; its renewal timer runs twice daily, but you should test renewal yourself before relying on it.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The sequence matters: certificate validation happens before HTTPS can work, so an incorrect A or AAAA record, blocked port 80, or a VirtualHost that does not name the requested hostname will stop issuance or send visitors to the wrong site.
As an Amazon Associate I earn from qualifying purchases.
How the pieces fit together
A browser requests a hostname such as example.com or app.example.com. DNS returns the Ubuntu server’s public address, the connection reaches Apache on port 80 or 443, and Apache selects a name-based VirtualHost by matching the request’s hostname against ServerName and ServerAlias. The selected host supplies its own DocumentRoot, logs and, for HTTPS, certificate and key.
Each hostname must therefore be correct in three places:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- DNS must resolve it to this server.
- The Apache VirtualHost must name it and point to the intended files.
- The certificate must include it as a certificate name.
A wildcard alias in Apache does not create DNS records and does not add wildcard coverage to a certificate.
Choose a certificate layout
| Layout | When it fits | Operational effect |
|---|---|---|
| One certificate with multiple names | A small group of related hosts that are managed together | Request every hostname with a separate -d option. The names become Subject Alternative Names on one certificate. |
| Separate certificate per site | Sites have different owners, lifecycles or deployment permissions | Run Certbot for each VirtualHost and renew them independently. |
| Wildcard certificate | You need many first-level subdomains such as *.example.com |
Use DNS-01 validation. HTTP-01 cannot issue a wildcard certificate. |
Let’s Encrypt certificates are valid for 90 days. Frequent, unattended renewal is expected rather than an exception.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Prepare DNS, ports and the Ubuntu host
Create records for every hostname
In the authoritative DNS service for your domain, create an A record for the server’s public IPv4 address and, if you use IPv6, an AAAA record for the public IPv6 address. For a main site and an application subdomain, the records might be:
| Hostname | Record | Value |
|---|---|---|
example.com |
A (and optionally AAAA) | Your Ubuntu server’s public address |
www.example.com |
A/AAAA or CNAME | An address that ultimately reaches the same server |
app.example.com |
A (and optionally AAAA) | Your Ubuntu server’s public address |
Check each name from outside the server before requesting a certificate. An old AAAA record is a common failure: a validator may prefer IPv6 and reach a different machine even though the A record is correct. Do not proceed until every address returned for a hostname reaches this Apache installation.
Allow HTTP and HTTPS
Allow inbound TCP 80 and 443 in both Ubuntu’s firewall and any cloud or network security group. Port 80 is normally required for Let’s Encrypt HTTP-01 validation, even when your finished site redirects all visitors to HTTPS. Port 443 is required for the resulting HTTPS service.
If port 80 cannot reach the server, or the server is intentionally private, plan to use DNS-01 validation instead. DNS-01 proves control by requiring a TXT record at _acme-challenge; it is also the validation method required for wildcard names.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesInstall Apache and Certbot
On a new Ubuntu server, install Apache and start it:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo apt update
sudo apt install apache2
sudo systemctl enable --now apache2Install Certbot and its Apache integration from Ubuntu’s current package guidance:
sudo apt install certbot python3-certbot-apacheIf Apache is already serving another site, keep it running while you add the new host. You can issue certificates only after the required HTTP VirtualHosts are reachable.
Create a document root and a VirtualHost for each site
Create separate document roots
Keeping each site in its own directory makes Apache’s routing explicit and prevents one application’s files from being served for another hostname.
Recommended Free Tools
sudo mkdir -p /var/www/example.com/public
sudo mkdir -p /var/www/app.example.com/public
sudo chown -R $USER:$USER /var/www/example.com
sudo chown -R $USER:$USER /var/www/app.example.comPlace a distinct test file in each root while configuring:
printf '%sn' 'main site' > /var/www/example.com/public/index.html
printf '%sn' 'application site' > /var/www/app.example.com/public/index.htmlDefine the main site’s HTTP host
Create /etc/apache2/sites-available/example.com.conf:
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/example.com/public
<Directory /var/www/example.com/public>
AllowOverride All
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/example-error.log
CustomLog ${APACHE_LOG_DIR}/example-access.log combined
</VirtualHost>ServerName is the canonical fully qualified domain name. Add every additional name that should serve the same files as a ServerAlias. The alias controls Apache routing; it does not change DNS or certificate contents.
Define the subdomain’s HTTP host
Create /etc/apache2/sites-available/app.example.com.conf:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
<VirtualHost *:80>
ServerName app.example.com
DocumentRoot /var/www/app.example.com/public
<Directory /var/www/app.example.com/public>
AllowOverride All
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/app-error.log
CustomLog ${APACHE_LOG_DIR}/app-access.log combined
</VirtualHost>This is how you point a subdomain to a different Apache site: give it its own VirtualHost and a different DocumentRoot. It can run on the same IP and Apache process as the main domain because Apache uses the hostname in each request to choose the site.
Enable and validate the hosts
Enable both files, test the complete Apache configuration, then reload:
sudo a2ensite example.com.conf
sudo a2ensite app.example.com.conf
sudo apachectl configtest
sudo systemctl reload apache2configtest must report Syntax OK. If it does not, fix the named file before reloading. Inspect Apache’s host map and ordering with:
sudo apachectl -SRequest each HTTP hostname and confirm that the expected test page appears. If a request shows Ubuntu’s default page or another site’s content, the intended file may not be enabled, the hostname may be missing from ServerName/ServerAlias, or an earlier default VirtualHost is catching the request.
Obtain and install the HTTPS certificate
Use the Apache plugin for ordinary public sites
Once DNS and HTTP routing work, request one certificate containing the main domain, its www name and the subdomain:
sudo certbot --apache -d example.com -d www.example.com -d app.example.comCertbot’s Apache plugin searches the VirtualHost blocks enabled in /etc/apache2/sites-enabled/, finds hosts matching the supplied names, adds the required TLS directives and reloads Apache. When prompted, choose the redirect option if you want HTTP requests sent to HTTPS after you have confirmed that HTTPS works.
Every -d option is important. A certificate for example.com does not automatically cover www.example.com or app.example.com. Supplying all names in one command places them on the same certificate as Subject Alternative Names. You may instead issue separate certificates by running Certbot for each site’s hostname set.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Use webroot mode when Certbot must not edit Apache
If deployment tooling or a hand-maintained configuration should remain untouched, obtain the certificate without installing it:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →sudo certbot certonly --webroot -w /var/www/app.example.com/public -d app.example.comWebroot mode places a temporary challenge file below /.well-known/acme-challenge/. Port 80 and the matching VirtualHost must serve that path publicly. You then reference the resulting certificate files from your own HTTPS VirtualHost.
Use DNS-01 for blocked HTTP or wildcards
Choose a DNS-01 plugin for your DNS provider when inbound port 80 is unavailable, the server is not directly reachable, or you need a name such as *.example.com. The process creates a TXT record at _acme-challenge.example.com; validation succeeds only after the authority can read that record. Follow the selected plugin’s package and credential instructions, and remove or protect long-lived DNS API credentials according to your provider’s security model.
DNS-01 does not remove the need for correct Apache configuration after issuance. Apache still needs a VirtualHost for each hostname that should serve content, and DNS still needs to direct those hostnames to the server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify HTTPS before enforcing redirects
Check each hostname and certificate name
Open all requested HTTPS URLs and verify that each one displays the intended document root, not merely a valid certificate. From a shell, you can inspect the response and certificate negotiation:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchcurl -I https://example.com
curl -I https://www.example.com
curl -I https://app.example.comThe browser’s certificate viewer should list the exact hostname in the certificate’s names. A valid certificate for the wrong host is still a configuration error.
Understand the generated TLS hosts
After a successful Apache-plugin run, Certbot normally creates or updates port-443 VirtualHosts associated with the matching names. Do not create a second competing HTTPS host with the same ServerName unless you understand which one Apache will select. Use sudo apachectl -S again to see the active 443 mappings.
Redirect HTTP only after HTTPS is proven
HTTP-01 renewal needs the challenge URL on port 80 to remain reachable. Certbot’s redirect choice is designed to preserve validation handling, but a hand-written redirect must not make /.well-known/acme-challenge/ inaccessible. Test both the normal redirect and the challenge path before deploying a custom rewrite rule.
If a site must be redirected manually, keep a dedicated port-80 VirtualHost for the hostname and explicitly exempt the ACME challenge location. Apply the redirect only after the corresponding 443 VirtualHost and certificate have been tested.
Know where certificates live and how renewal works
Certificate and key files
Certbot stores the live files under:
/etc/letsencrypt/live/<domain>/fullchain.pem contains the server certificate followed by its intermediate certificates. privkey.pem is the private key and must remain readable only by the services that need it. Do not copy the private key into a web root or commit it to a repository.
A manually managed HTTPS VirtualHost typically references these paths:
<VirtualHost *:443>
ServerName app.example.com
DocumentRoot /var/www/app.example.com/public
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/app.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/app.example.com/privkey.pem
<Directory /var/www/app.example.com/public>
AllowOverride All
Require all granted
</Directory>
</VirtualHost>When the Apache plugin manages the host, it writes equivalent TLS directives for you. Avoid editing generated files blindly; inspect apachectl -S and the enabled site files first.
Test unattended renewal
Ubuntu’s Certbot setup installs a systemd timer that attempts renewal twice a day. Run a dry run after issuance and after significant DNS, firewall or Apache changes:
sudo certbot renew --dry-runA successful dry run exercises the renewal path without replacing the live certificate. Apache installations managed by the plugin are reloaded after a successful renewal so the new certificate is served. If the dry run fails, fix that failure before the 90-day certificate lifetime becomes urgent.
Point a new subdomain to a different Apache site
For a second application such as api.example.com, repeat the same sequence rather than adding files to the first site’s root:
- Create an A and, if applicable, AAAA record for
api.example.comthat reaches this server. - Create a new directory such as
/var/www/api.example.com/publicand set its ownership and application permissions. - Create
/etc/apache2/sites-available/api.example.com.confwithServerName api.example.com, its ownDocumentRoot, aDirectoryblock and separate logs. - Run
sudo a2ensite api.example.com.conf, thensudo apachectl configtestandsudo systemctl reload apache2. - Confirm the HTTP site is reachable and then add
-d api.example.comto a new or existing Certbot request. - Verify the resulting HTTPS URL and run
sudo apachectl -Sif Apache serves the wrong content.
Do not rely on a wildcard ServerAlias to perform these steps automatically. Ubuntu supports patterns such as ServerAlias *.mynewsite.com, but each real hostname still needs DNS resolution and certificate coverage.
Quick Recap
Troubleshoot the failures that matter most
| Symptom | Likely cause | Fix |
|---|---|---|
| Certbot says the domain could not be validated | An A or AAAA record is missing, stale or points elsewhere. | Query every hostname from an external resolver and correct all returned addresses before retrying. |
| HTTP-01 times out | TCP 80 is blocked by Ubuntu’s firewall, a cloud security group, NAT or an upstream firewall. | Allow inbound 80 to Apache, or switch to DNS-01 when opening the port is impossible. |
| HTTPS works for one name but shows another site’s files | The hostname is absent from ServerName/ServerAlias, the site is not enabled, or an earlier default host wins. |
Check the enabled files, run sudo apachectl -S, correct the host declaration and reload. |
| Apache refuses to reload | A syntax error, duplicate directive or malformed path exists in a site file. | Run sudo apachectl configtest; fix the reported file and test again before reloading. |
| The certificate is valid but the browser reports a name mismatch | The requested hostname was not included in the certificate’s names. | Run Certbot again with a -d option for that exact hostname, then verify the active 443 VirtualHost. |
| Renewal dry run fails after a redirect was added | The redirect or rewrite prevents access to /.well-known/acme-challenge/. |
Leave the challenge path reachable on port 80 or use DNS-01; retest with sudo certbot renew --dry-run. |
| IPv4 works but validation still fails | An AAAA record sends validators to a host that is not configured. | Configure IPv6 on this server and allow port 80/443, or remove the incorrect AAAA record. |
| Renewal succeeds but Apache still serves the old certificate | A manually managed process did not reload, or the active VirtualHost references a different path. | Confirm the paths under /etc/letsencrypt/live/, inspect the active host with apachectl -S, and reload Apache after renewal. |
Final deployment checklist
- Every production hostname has correct A and, where used, AAAA DNS records.
- TCP 80 and 443 are allowed at both the Ubuntu host and any external firewall.
- Each site has a distinct enabled VirtualHost with the right
ServerName, aliases and document root. sudo apachectl configtestreportsSyntax OK, andsudo apachectl -Sshows the expected host ordering.- The certificate request includes every hostname users will visit.
- Each HTTPS URL serves the intended site and presents a certificate containing that exact name.
- The HTTP challenge path remains reachable if you use HTTP-01.
sudo certbot renew --dry-runcompletes successfully before you depend on unattended renewal.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
