Free tools Windows power users keep installed
One-click scans. No signup required.
Yes. You can host many unrelated domains on one VPS and one public IP, each with its own website and HTTPS certificate. Point every domain at the VPS in DNS, give each hostname an Nginx server block, and use TLS Server Name Indication (SNI) so Nginx selects the right certificate when a browser connects.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The reliable sequence is DNS and firewall first, separate HTTP site configurations second, certificate issuance third, HTTPS configuration fourth, and verification last. Certbot can manage one certificate per domain or a shared Subject Alternative Name (SAN) certificate containing several domains. The choice affects isolation, renewal work and the damage caused by a failed certificate change.
As an Amazon Associate I earn from qualifying purchases.
How one VPS serves several HTTPS domains
Name-based virtual hosting lets one web server distinguish requests by the hostname in the HTTP request. During an HTTPS connection, the client sends that hostname in SNI before encrypted HTTP begins. Nginx uses the SNI name to choose the matching TLS server block and certificate, then routes the request to that block’s document root or upstream application.
For example, example.com, example.net and shop.example.org can all resolve to the same IPv4 address. Nginx still keeps their files, logs, proxy targets and certificates separate. A single IP is therefore not a reason to buy one certificate for every site or a separate VPS for every domain.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Every HTTPS hostname must be present in the certificate selected for that connection. If Nginx falls back to a default server or the certificate does not list the requested name in its Subject Alternative Name (SAN) extension, browsers show a name-mismatch warning such as NET::ERR_CERT_COMMON_NAME_INVALID.
Prerequisites and design decisions
- A VPS with a public IPv4 address, and optionally IPv6, running a supported Linux distribution.
- Administrative access to install Nginx and Certbot and to create files under the web roots.
- Authoritative DNS access for every domain and hostname you intend to serve.
- Inbound TCP port 80 for HTTP and ACME HTTP-01 validation, plus TCP port 443 for HTTPS.
- A decision about whether each hostname serves static files, proxies to an application, or needs both.
- A certificate plan: separate certificates, one SAN certificate, or a wildcard for subdomains of one registrable domain.
Keep each site’s files, logs and Nginx configuration distinct even when several sites share a VPS. Separation makes ownership clearer, limits accidental exposure, and lets you disable or renew one domain without changing unrelated sites.
Step 1: Point DNS at the VPS and open the firewall
- Create an A record. For each apex domain, set an A record such as
example.com A 203.0.113.10, replacing the address with the VPS’s public IPv4 address. - Create the desired aliases. If you will serve
www.example.com, create its A record or a CNAME that ultimately resolves to the VPS. Repeat for every hostname that will appear in an Nginxserver_namedirective or certificate request. - Add AAAA records only when IPv6 works. An incorrect AAAA record can send validation clients to a different machine even when the A record is correct. Do not publish IPv6 DNS until Nginx and the firewall listen on the VPS’s IPv6 address.
- Allow TCP 80 and 443. Permit these ports in the VPS provider firewall, the operating-system firewall and any network firewall in front of the server. SSH can remain restricted to trusted administration addresses.
- Check resolution before requesting a certificate. Query each A and AAAA record from outside the VPS and confirm that every hostname reaches the intended machine. ACME validation cannot succeed while DNS still points elsewhere.
HTTP-01 validation works by having Certbot place a token under /.well-known/acme-challenge/. The certificate authority then fetches that exact path over HTTP. The hostname must therefore resolve correctly and port 80 must be reachable from the public internet.
Step 2: Create an HTTP server block for each domain
Use one port-80 server block per site. Put exact hostnames, aliases and the site-specific root or proxy target in that block. Separate blocks prevent one site’s files or logs from being selected for another hostname and make certificate mapping easier to audit.
Static site example
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/example;
index index.html;
location /.well-known/acme-challenge/ {
try_files $uri =404;
}
location / {
try_files $uri $uri/ =404;
}
}Create the directory named in root, place a test file there, and ensure the Nginx worker can read it. A separate block for another domain would use its own server_name and root:
server {
listen 80;
listen [::]:80;
server_name example.net www.example.net;
root /var/www/example-net;
index index.html;
location /.well-known/acme-challenge/ {
try_files $uri =404;
}
location / {
try_files $uri $uri/ =404;
}
}Reverse-proxy site example
For an application listening on a local port, keep the challenge path on the filesystem and proxy ordinary requests to the application:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
server {
listen 80;
listen [::]:80;
server_name app.example.org;
root /var/www/acme-app;
location /.well-known/acme-challenge/ {
try_files $uri =404;
}
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}The upstream port is only an example; use the port on which your application actually listens. The important detail is that the ACME URL reaches a predictable directory instead of being intercepted by an application route.
Step 3: Choose a certificate strategy
| Strategy | What it covers | Advantages | Trade-offs |
|---|---|---|---|
| Separate certificates | One domain and its requested aliases per certificate | Independent renewal, revocation and delegation; a problem affects fewer sites | More certificate files and renewal events to monitor |
| SAN certificate | Several explicitly named, possibly unrelated domains in one certificate | Fewer certificate objects and a smaller Nginx configuration | Adding or removing one name changes the shared certificate and couples the domains |
| Wildcard certificate | Subdomains under one registrable domain, such as *.example.com |
Convenient for many subdomains whose names change | It covers only one label level; it does not cover an unrelated domain or deeper names such as a.b.example.com automatically |
Use separate certificates when domains belong to different teams, have different lifecycles or need the smallest possible failure blast radius. A SAN certificate is practical for a group you operate together and expect to renew as one unit. A wildcard is suitable only when every required name is under the same registrable domain and you accept the validation and key-management implications.
Step 4: Obtain certificates with Certbot
Certbot can use its Nginx installer to obtain a certificate and edit Nginx, or it can run in certonly mode so you retain full control over the configuration. Request every alias that users will visit; a certificate for the apex name alone does not cover the www hostname.
One certificate for a site
sudo certbot --nginx -d example.com -d www.example.comThe Nginx plugin discovers the matching HTTP server block and can install the resulting certificate. Review the proposed changes before accepting them, especially when several similarly named blocks exist.
Separate certificates with webroot validation
sudo certbot certonly --webroot -w /var/www/example
-d example.com -d www.example.com
sudo certbot certonly --webroot -w /var/www/example-net
-d example.net -d www.example.netWith webroot validation, Certbot writes challenge files below each specified directory. The Nginx block for that hostname must serve the same directory at /.well-known/acme-challenge/. If a request reaches another root, validation fails even though the DNS record is correct.
One SAN certificate for several domains
sudo certbot certonly --webroot -w /var/www/example
-d example.com -d www.example.com
-d example.net -d www.example.net
-d app.example.orgWhen domains use different web roots, use a validation method and configuration that can serve the challenge for each name, or make separate requests. Certbot supports multiple -d options in one request; it does not require all names to share one document root when the validation setup is designed correctly.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Wildcard issuance normally requires DNS validation because a wildcard cannot be validated through an ordinary HTTP-01 file. Your DNS provider must support the required TXT record workflow, either manually or through an appropriate Certbot DNS plugin. Use DNS validation when port 80 cannot be exposed, but protect DNS credentials carefully because they can change the entire zone.
Step 5: Add an HTTPS block and map the certificate
After issuance, create a port-443 block for each hostname. The certificate path shown below is Certbot’s conventional live symlink path; use the directory name created for your own request.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
root /var/www/example;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}For a proxied application, retain the same TLS directives but replace the content location with the upstream settings from the HTTP block. Repeat the HTTPS block for each domain and point each block at the certificate whose SAN list contains all names in that block.
Do not assume that the first certificate installed on the VPS is suitable for every site. Nginx selects a certificate by matching the requested SNI name to server_name. An unmatched name uses the default HTTPS server, which is why a browser can receive a valid certificate for a completely different domain.
Step 6: Redirect HTTP without breaking renewal
Once HTTPS works, redirect normal HTTP requests permanently while preserving the original host and URI:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location /.well-known/acme-challenge/ {
root /var/www/example;
try_files $uri =404;
}
location / {
return 301 https://$host$request_uri;
}
}The explicit challenge location is important when you continue using HTTP-01 for renewal. A redirect may also be followed by ACME clients, but serving the token directly avoids ambiguity and makes troubleshooting easier. Apply the equivalent block to every hostname that renews through HTTP.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Step 7: Test, reload and verify every site
- Test the configuration. Run the Nginx configuration test supplied by your distribution, commonly
sudo nginx -t. Do not reload if it reports a syntax error, missing file or duplicate conflict. - Reload safely. Reload Nginx through your operating system’s service manager so existing connections are not unnecessarily terminated.
- Check HTTP routing. Request each hostname and confirm it reaches the intended root or application, not the default site.
- Check HTTPS routing. Visit every apex and alias hostname. Inspect the presented certificate’s SAN list and expiration date, and verify that the chain is complete.
- Test the challenge path. Create a temporary file below the configured challenge directory and request the exact
/.well-known/acme-challenge/URL over HTTP, then remove the file. - Test renewal before relying on it. Use Certbot’s renewal test procedure in a staging or non-production workflow and confirm that the resulting deployment reloads Nginx successfully. The exact timer, hook and reload behavior depends on the operating system and how Certbot was installed.
Testing by IP address is not a substitute for testing by hostname. SNI and Nginx name matching depend on the hostname supplied by the client, so an IP-only request can legitimately show the default certificate.
Diagnose common failures
The browser reports a wrong certificate
- Confirm the requested hostname appears in the certificate’s SAN list.
- Confirm the same hostname appears in the relevant HTTPS
server_namedirective, including thewwwalias if applicable. - Check that the intended HTTPS block is enabled and that another block has not become the default server.
- Inspect for duplicate or overlapping server names and reload only after
nginx -tsucceeds.
SNI lets several certificates share one IP, but only when the client sends the hostname and Nginx has an unambiguous matching block.
ACME authorization fails
- DNS may still point to an old server or an incorrect AAAA address.
- Port 80 may be blocked by a provider firewall, local firewall or upstream network.
- The challenge URL may be routed to the wrong document root, application or virtual host.
- A redirect, access rule or authentication layer may prevent the public validator from reading the token.
Resolve the hostname from an external network, request the exact challenge path, and verify that the expected token is returned without authentication. If inbound HTTP cannot be made available, use DNS validation instead.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The default site captures a domain
Nginx uses a default server when no server_name matches, or when an empty or unmatched name is received. Remove an unwanted distribution default site, or configure it deliberately as a harmless catch-all. Then make every production hostname explicit in both its port-80 and port-443 blocks.
An internationalized domain does not match
Use the ASCII Punycode form of an internationalized domain in Nginx’s server_name and certificate request. Browsers may display the human-readable Unicode form, but hostname matching and certificate names use the encoded form.
Renewal succeeds but the old certificate remains active
Certificate files can be renewed without the running Nginx process reloading them. Confirm that the renewal deployment hook or service integration actually reloads Nginx, then inspect the certificate presented over the network rather than only checking files on disk. Because timer and hook behavior varies by operating system and installation method, verify it in a controlled environment before making it a production assumption.
Operational practices for a multi-domain VPS
Keep configuration and data separated
Use a predictable directory layout such as /var/www/example and /var/www/example-net, separate access and error logs, and least-privilege ownership. A compromised application should not automatically be able to modify another site’s files or private keys.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Back up what is difficult to recreate
Back up application data, databases, Nginx configuration, DNS records and the certificate-account information required for recovery. Private keys deserve restricted permissions and encrypted backups. A certificate can be reissued, but restoring a complete configuration quickly reduces downtime.
Monitor expiry and reachability
Monitor every public hostname, not just the VPS IP. Alert on certificate expiry, failed renewal, HTTP-to-HTTPS redirect loops, unexpected default-site responses and upstream application failures. A single VPS failure affects all hosted domains, so provider-level backups and an outage plan matter more as the number of sites grows.
Apply changes incrementally
Add and test one domain at a time, then reload Nginx. When changing a SAN certificate, remember that removing or mistyping one name changes the shared certificate for every domain in that request. Separate certificates reduce that coupling when sites have independent operators or release schedules.
What this setup does and does not provide
Hosting multiple domains on one VPS reduces infrastructure overhead, but it does not create isolation equivalent to separate machines. All sites share the server kernel, CPU, memory, disk and network interface. Resource exhaustion or a kernel-level compromise can affect every domain. Use process limits, application isolation, patching, backups and monitoring appropriate to the risk of the sites you host.
At the TLS layer, one public IP is sufficient because SNI is designed for name-based HTTPS. The essential conditions are accurate DNS, reachable validation paths, explicit Nginx names and a certificate whose SAN list covers every hostname users request.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
