The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use this order: point DNS to the VPS, open ports 80 and 443, obtain a Let’s Encrypt certificate with Certbot, configure Apache or Nginx to serve the full chain on 443, then enable secure URLs in PrestaShop and test every customer path. HTTPS is not complete when a certificate merely exists on disk. The web server, PrestaShop, payment callbacks, assets, proxies and renewal process must all agree that the canonical shop URL is HTTPS.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide covers both Apache and Nginx, HTTP-01 and DNS-01 validation, single- and multi-host shops, mixed-content failures, renewal checks and the point at which HSTS is safe.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat you need before changing anything
HTTPS on a VPS is a chain of dependent settings. Gather these details first so you do not request a certificate for the wrong virtual host or enable secure URLs before the server can answer on port 443.
- Exact PrestaShop version and whether the shop is single-store or multistore.
- Linux distribution and release.
- Web server: Nginx, Apache, or a proxy in front of either one.
- PHP arrangement: PHP-FPM socket or TCP endpoint for Nginx, or mod_php/PHP-FPM integration for Apache.
- PrestaShop document root, such as
/var/www/prestashop, and the user that owns the files. - Canonical hostname, whether
wwwis used, and every subdomain used for the shop, back office, API, images or callbacks. - Any CDN, load balancer or reverse proxy that terminates TLS before traffic reaches the VPS.
Back up the PrestaShop database and files, and save a copy of the current web-server configuration. Certbot installers can edit Apache or Nginx automatically, but a configuration backup gives you a rollback path if a virtual host or rewrite rule is changed unexpectedly.
#1 Best Overall
DNS, ports and certificate names
Point every required hostname to the VPS
Create or verify an A record for each hostname that must appear in the certificate. Add an AAAA record only when IPv6 on that VPS is configured and reachable. Typical names are example.com and www.example.com; add any shop-specific subdomains customers or modules actually use.
Do not request a normal publicly trusted certificate for an IP address. Use DNS names, and make sure the virtual host selected by Apache or Nginx has those same names in its ServerName/ServerAlias or server_name directives.
Free tools Windows power users keep installed
One-click scans. No signup required.
Allow the validation and customer traffic
Permit inbound TCP 80 and 443 in both the VPS firewall and the hosting provider’s firewall. HTTP-01 validation requires an Internet-reachable port 80 so the certificate authority can fetch a challenge file. If policy prevents exposing port 80, use DNS-01 validation instead; it proves control by publishing a DNS record and does not require an inbound HTTP service.
Check DNS from outside the VPS before running Certbot. An old address, an unreachable IPv6 record, or a proxy that sends the request elsewhere will cause validation to fail even when the certificate command is correct.
Choose a validation and installation approach
| Choice | When it fits | Important trade-off |
|---|---|---|
| HTTP-01 | Port 80 can reach this VPS and the web server can serve the ACME challenge path. | Every name being validated must resolve to the server handling the challenge. |
| DNS-01 | Port 80 cannot be exposed, or you need a wildcard certificate. | You must publish and remove DNS challenge records, manually or through a DNS provider integration. |
| Certbot Apache/Nginx installer | You want Certbot to obtain the certificate and edit a supported web-server configuration. | Review the proposed changes and keep a configuration backup. |
certonly |
You want certificates but will write and maintain the TLS virtual host yourself. | You are responsible for certificate paths, redirects, reloads and renewal hooks. |
A single certificate containing all names is convenient for one shop, while separate certificates can reduce the impact of a change in a larger deployment. Choose according to the domains you operate and how you want renewals managed; do not include names that are not under your control.
Install Certbot for the actual operating system
Use the current Certbot instructions for the distribution and web server installed on this VPS. Package names and supported methods differ between distributions, so an Ubuntu command should not be copied to a different operating system without checking.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The documented snap-based path installs Certbot, links /snap/bin/certbot into /usr/local/bin, and then uses the Apache or Nginx plugin. Confirm the executable after installation:
certbot --versionRun Certbot with administrative privileges. If your distribution supplies a maintained package and timer, that method can also be appropriate; the important requirement is a supported, regularly updated Certbot installation and a renewal job.
Rank #2
Obtain the certificate
Automatic Apache installation
For an Apache site whose DNS and virtual host are already correct, the integrated command is:
sudo certbot --apacheCertbot lists the detected names, asks which should be secured and can create the HTTP-to-HTTPS redirect. Select every hostname customers actually use, including www when it remains active. Review the resulting virtual host before and after the change.
Recommended Free Tools
Automatic Nginx installation
For Nginx, use:
sudo certbot --nginxThe plugin edits the matching server block and can add a redirect. It must be able to identify the correct server_name; duplicate or catch-all blocks can cause the wrong site to be changed.
Certificate only, with manual server configuration
Use certonly when you want to control every web-server edit:
sudo certbot certonly --webroot -w /var/www/prestashop -d example.com -d www.example.comReplace the webroot with the directory actually served by the selected virtual host. The webroot plugin writes a temporary file below /.well-known/acme-challenge; that path must be reachable over HTTP without being blocked by authentication, a rewrite rule or a proxy.
For DNS-01, select the authenticator supported by your DNS provider and follow its record-publication procedure. Do not paste a DNS plugin command from another distribution or provider without checking its current documentation.
Successful certificates are stored below /etc/letsencrypt/live/ under the certificate name. The web server should reference the files in that directory rather than copying dated files elsewhere.
Configure Nginx for PrestaShop
Adapt PrestaShop’s official Nginx template to your paths, PHP-FPM endpoint and canonical hostname. It is an example, not a drop-in file. A minimal arrangement has one HTTP block for the challenge and redirect, and one TLS block:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/prestashop;
location ^~ /.well-known/acme-challenge/ {
try_files $uri =404;
}
location / {
return 301 https://example.com$request_uri;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name example.com www.example.com;
root /var/www/prestashop;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
# Add the PrestaShop PHP-FPM and front-controller rules here.
}Use fullchain.pem, not only the leaf certificate, so browsers receive the intermediate chain. Protect privkey.pem with the permissions required by Nginx and do not expose it through the document root.
Keep the HTTP block available for renewal. Redirect normal requests permanently to one canonical HTTPS hostname, but allow the ACME challenge location to be served when Certbot needs it. If a CDN or proxy handles the challenge, ensure it forwards the path to the system where Certbot writes the file.
Test and reload only after the configuration parses:
sudo nginx -t
sudo systemctl reload nginxConfigure Apache for PrestaShop
Create or adapt a TLS virtual host with the correct document root, names, certificate chain and key. A representative structure is:
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/prestashop
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
<Directory /var/www/prestashop>
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/prestashop
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge/
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
</VirtualHost>Enable the SSL and rewrite modules required by your distribution, and keep AllowOverride All when PrestaShop’s .htaccess rules are needed. The PHP handler, module names and filesystem paths must match the installed system; PrestaShop’s example is a template rather than a universal configuration.
Validate before reloading:
sudo apachectl configtest
sudo systemctl reload apache2Use the service name supplied by your distribution if it is not apache2. Confirm that the 443 virtual host presents the expected names and complete chain.
Enable secure URLs inside PrestaShop
Server-side TLS does not automatically make PrestaShop generate HTTPS links. In the Back Office, open the shop’s SSL or secure-URL setting in the general shop configuration (the exact label and location vary by PrestaShop version), enable SSL and, where offered, enable SSL on all pages. Apply the setting for the correct shop context.
If SSL was enabled during installation, still verify the setting after changing the domain or proxy. The PrestaShop command-line installer has an ssl option from version 1.7.4 onward, but an existing shop should be checked in its Back Office configuration rather than assumed to have inherited that installation value.
Rank #4
Clear PrestaShop’s cache after changing URL or rewrite settings. Regenerate or verify friendly URLs if the shop reports routing errors. Front controllers and modules that require secure requests should redirect non-SSL calls; PrestaShop documents SSL-aware controllers for that purpose.
Multistore and integrations
In a multistore deployment, inspect every shop and domain context separately. Update canonical URLs, payment return addresses, webhooks, API endpoints, module callbacks and any CDN or proxy origin URL to HTTPS. A certificate covering only the main domain does not secure a separate back-office or asset hostname.
Remove hard-coded http:// references from themes, overrides and modules. Prefer protocol-relative-free, explicit HTTPS URLs or generated shop URLs. If TLS terminates at a reverse proxy, pass the original protocol and configure the application to trust that proxy; otherwise PrestaShop can believe the request is HTTP and generate insecure redirects or loops.
Redirect and test the complete shop
Do not stop at the home page. Test the canonical name and the www variant when it is published, then exercise the paths that can expose an incomplete migration.
- Open the HTTPS home page and confirm the browser shows the expected certificate names and a valid chain.
- Request the HTTP URL and confirm it makes one intentional 301 redirect to the chosen canonical HTTPS URL, without a redirect loop.
- Open the Back Office, sign in, sign out and verify that session cookies are marked Secure where appropriate.
- Add products to the cart, change quantities, apply a voucher, begin checkout and complete a payment test or provider-return test.
- Check payment callbacks, webhooks, module AJAX requests and any external API endpoint used by the shop.
- Inspect images, CSS, JavaScript, fonts and iframe resources. Browser developer tools should show no mixed-content errors.
- Test the ACME path used by your authenticator and confirm it is not blocked by a blanket redirect, access rule or authentication prompt.
Certbot’s basic confirmation is to visit the HTTPS URL in a browser and check the lock indicator, but an operational shop needs the deeper checks above. Also inspect the certificate from an external network so a local proxy or cached DNS response does not hide a public problem.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Fix common failures
“Certbot cannot validate the domain”
- Verify every
AandAAAArecord resolves to the VPS that will answer the challenge. - Open TCP 80 in both firewalls for HTTP-01, or switch to DNS-01 when port 80 cannot be reachable.
- Ensure the selected virtual host serves
/.well-known/acme-challenge/from the same webroot supplied to Certbot. - Remove authentication, deny rules and application rewrites that intercept the challenge path.
- Check that a proxy or load balancer is not sending the request to a different origin.
The browser reports an incomplete chain
Point Apache or Nginx at fullchain.pem and reload the service. Referencing only the leaf certificate can work in some browsers and fail in others because the intermediate certificate was not sent.
PrestaShop redirects in a loop
Check that the HTTPS virtual host is actually selected, the canonical URL uses the same hostname as the certificate, and a reverse proxy forwards the original protocol. A proxy that omits the HTTPS indication can make PrestaShop redirect an already secure request back to HTTPS repeatedly.
The site is secure but assets are blocked
Use developer tools to identify the exact insecure URL. Correct theme or module configuration, database-stored media links, callback settings and third-party embeds. Do not “fix” mixed content by disabling browser security; every required resource should be available over HTTPS.
Only some domains work
Add the missing names to DNS, the certificate request and the matching virtual-host aliases. In multistore mode, verify that each domain is assigned to the intended shop context and that its redirect target is correct.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAutomate and verify renewal
Let’s Encrypt certificates are short-lived, so renewal must be unattended and observable. Certbot installations normally provide a systemd timer or cron entry that runs certbot renew. Check the schedule supplied by your installation:
systemctl list-timers | grep certbotRun a staging renewal test where supported:
sudo certbot renew --dry-runA dry run verifies the challenge and renewal workflow without replacing the production certificate. Keep Certbot updated according to your distribution or snap channel.
Renewal is incomplete if the files change but the web server continues serving the old certificate. Configure a deploy hook or equivalent reload action, then verify the result from outside the VPS. A simple hook can reload the relevant service after a successful renewal:
sudo systemctl reload nginxUse the Apache service instead when Apache terminates TLS. If both services or a proxy are involved, reload the component that presents the public certificate. Monitor renewal logs and set an alert for failures; test again after changing DNS, firewall rules, proxy routes or server configuration.
When to enable HSTS
HTTP Strict Transport Security tells browsers to use HTTPS automatically. It can protect visitors from downgrade attacks, but it also makes recovery harder because browsers remember the policy. Enable it only after every hostname, asset, callback, API endpoint, administrative path and renewal challenge works over HTTPS.
PrestaShop’s Nginx example leaves its HSTS line commented and warns not to use it while the site is not fully on HTTPS. Start with a conservative policy for the exact host, verify the entire migration, and expand only when you are certain that every required subdomain supports HTTPS. Do not include subdomains or preload behavior casually; an unreachable subdomain can become inaccessible to returning browsers.
Operational checklist
- DNS records for all required names resolve to the intended VPS.
- TCP 80 and 443 are allowed where the chosen validation and public traffic require them.
- Certificate names match the canonical and alternate hostnames.
- Port 443 serves the full chain and the private key from protected paths.
- HTTP redirects once to the chosen HTTPS hostname while ACME challenges remain reachable.
- Nginx or Apache syntax passes, and the service has been reloaded.
- PrestaShop SSL settings, cache, canonical URLs and multistore contexts are correct.
- Back Office, login, cart, checkout, payment return, assets and AJAX calls work without mixed content.
- Certbot renewal timer or cron runs, a dry run succeeds and a deploy reload presents the renewed certificate.
- HSTS is deferred until the migration is complete.
The Bottom Line
Enable HTTPS in layers: make DNS and validation reachable, obtain the certificate, configure the web server with the full chain, enable secure URLs in each PrestaShop context, test real checkout and integrations, then automate renewal. Treat HSTS as the final step, not the first.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
