The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Install the certificate chain and matching private key on Nginx, enable an HTTPS server block on port 443, redirect the canonical HTTP hostname, and then change WordPress’s own URLs to https://. The critical details are certificate-chain order, private-key permissions, and avoiding conflicting redirects when a proxy or CDN is involved.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What you are installing
A third-party TLS certificate is issued by a certificate authority for one or more hostnames. Nginx presents that certificate to browsers, proves possession of the corresponding private key, and negotiates an encrypted connection. WordPress does not store or interpret the certificate; it generates links and handles cookies using the scheme and host that your web-server setup exposes.
As an Amazon Associate I earn from qualifying purchases.
A normal installation has three inputs:
- Leaf (server) certificate: the certificate issued for your domain, such as
example.com.crtorexample.com.pem. - Private key: the PEM key generated with the certificate-signing request (CSR), such as
example.com.key. This must be the key that matches the leaf certificate. - Intermediate bundle: one or more issuer certificates, often called
bundle.crt,ca-bundle.crt, orintermediate.pem.
The certificate is public: Nginx sends it to every connecting client. The private key is secret and must remain readable only by the Nginx master process and the administrators who need to maintain it.
Choose the certificate coverage before you configure Nginx
Make sure the certificate covers every hostname that users will actually visit. A certificate for www.example.com does not automatically cover the bare example.com, and a certificate for one subdomain does not cover another.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Certificate type | Typical coverage | What to verify |
|---|---|---|
| Single-name | One exact hostname | The certificate’s subject or SAN includes the precise canonical hostname. |
| Wildcard | A wildcard such as *.example.com generally covers one label, for example shop.example.com |
The bare domain and deeper subdomains may require additional SAN entries; read the certificate’s SAN list. |
| SAN (multi-name) | Several explicitly listed hostnames | Every HTTPS name used by the site, redirects, APIs, and administration endpoints is listed. |
Also confirm how renewal works. Some authorities provide a new certificate and bundle while you keep the existing key; others expect a new CSR and key. Record which files belong together and whether your hosting or automation process replaces them in place.
Prepare the certificate, bundle, and key files
1. Confirm the files are PEM text
Nginx’s ssl_certificate directive expects a PEM-encoded certificate. Open the files in a text viewer and look for markers such as -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. A private key normally begins with -----BEGIN PRIVATE KEY-----, -----BEGIN RSA PRIVATE KEY-----, or an equivalent encrypted-key marker.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsDo not paste a binary DER certificate directly into the Nginx configuration. If your issuer supplied a different format, convert it to PEM with the issuer’s documented procedure before continuing.
2. Build one chained certificate file
Place the leaf certificate first and append the intermediate bundle after it. This ordering is required because Nginx uses the first certificate as the server certificate and sends the following certificates as the chain.
sudo mkdir -p /etc/nginx/ssl/example.com
sudo cp example.com.crt /etc/nginx/ssl/example.com/
sudo cp bundle.crt /etc/nginx/ssl/example.com/
sudo cp example.com.key /etc/nginx/ssl/example.com/
sudo sh -c 'cat /etc/nginx/ssl/example.com/example.com.crt
/etc/nginx/ssl/example.com/bundle.crt
> /etc/nginx/ssl/example.com/example.com.chained.crt'The resulting example.com.chained.crt must contain the server certificate before every intermediate. Do not append the private key to this file; the key belongs in the separate file named by ssl_certificate_key.
3. Inspect the certificate names and dates
openssl x509 -in /etc/nginx/ssl/example.com/example.com.crt
-noout -subject -issuer -dates -ext subjectAltNameCheck that the SAN list contains the hostname in your Nginx server_name, and check the notBefore and notAfter dates. A valid chain cannot compensate for a certificate issued to the wrong name or one that has expired.
Recommended Free Tools
4. Check that the private key is usable
For an unencrypted key, ask OpenSSL to parse it:
openssl pkey -in /etc/nginx/ssl/example.com/example.com.key -check -nooutIf the key is encrypted, OpenSSL will request its passphrase. Nginx generally needs unattended access when the service starts, so decide whether your distribution and deployment process support an encrypted key prompt. Never remove encryption or loosen permissions casually just to make a start-up error disappear.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
To verify that the certificate and key belong together without relying on RSA-only modulus commands, compare their public keys:
openssl x509 -in /etc/nginx/ssl/example.com/example.com.crt -pubkey -noout > /tmp/cert.pub
openssl pkey -in /etc/nginx/ssl/example.com/example.com.key -pubout > /tmp/key.pub
diff -u /tmp/cert.pub /tmp/key.pubNo differences indicate that the public key derived from the certificate matches the one derived from the private key. Delete the temporary public-key files after checking if the server is shared.
Protect the private key while allowing Nginx to read it
Store the files outside the web root so a URL cannot expose them. The certificate and chain are not secrets, but the key is. A common arrangement is a root-owned directory with restrictive permissions:
sudo chown -R root:root /etc/nginx/ssl/example.com
sudo chmod 700 /etc/nginx/ssl/example.com
sudo chmod 644 /etc/nginx/ssl/example.com/example.com.crt
sudo chmod 644 /etc/nginx/ssl/example.com/example.com.chained.crt
sudo chmod 600 /etc/nginx/ssl/example.com/example.com.keyThe exact owner and group depend on your operating system. Nginx’s master process must be able to read the key before it drops worker privileges. If your distribution uses a dedicated group for certificate access, grant that group read permission instead of making the key world-readable. Verify the effective service account and mandatory-access-control policy (such as SELinux or AppArmor) if a correctly permissioned key still produces a “permission denied” error.
Configure the HTTPS server block
Place the following in the site configuration loaded by Nginx. On many Linux installations this is a file under /etc/nginx/sites-available/ linked into /etc/nginx/sites-enabled/; other distributions use /etc/nginx/conf.d/. Use the layout already used by your installation.
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
root /var/www/example.com;
index index.php index.html;
ssl_certificate /etc/nginx/ssl/example.com/example.com.chained.crt;
ssl_certificate_key /etc/nginx/ssl/example.com/example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php-fpm.sock;
}
}Replace the hostname, document root, and PHP-FPM socket with the values used by your server. The important TLS directives are listen 443 ssl;, server_name, ssl_certificate, and ssl_certificate_key. The certificate path points to the chained file, not merely the leaf certificate.
The modern syntax is the ssl parameter on the listen directive. The standalone ssl on; directive became obsolete in Nginx 1.15.0 and was removed in 1.25.1, so do not copy an old configuration that uses it. Nginx documentation identifies TLS 1.2 and TLS 1.3 as defaults beginning with version 1.23.4, but verify your installed Nginx and OpenSSL versions rather than assuming those defaults. Explicitly listing TLSv1.2 TLSv1.3 avoids accidentally enabling older protocols when the build or inherited configuration differs.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
If you serve only one canonical hostname, keep the other name in a separate redirect server block or include it in the certificate and redirect it deliberately. A certificate-name mismatch occurs before an HTTP redirect can help, because the TLS handshake happens first.
Keep an HTTP listener and redirect it safely
Port 80 should normally remain available so old bookmarks and links reach the HTTPS site. Use a separate HTTP server block that preserves the requested path and query string while selecting one canonical host:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}This sends both HTTP hostnames to https://example.com and keeps the URI in $request_uri. If www.example.com is your canonical host, change the destination accordingly. Do not create two competing redirect rules that alternately add and remove www; decide the canonical hostname first and use it consistently in the certificate, Nginx blocks, WordPress settings, and canonical links.
A permanent redirect is appropriate once the configuration is correct, but browsers cache 301 responses. During a migration, test with a temporary response or a command-line client before committing to a permanent redirect if you are still changing host rules.
Test and activate Nginx
- Check the complete configuration, including included files:
sudo nginx -tThe expected result is a syntax test that reports the configuration is successful. Fix every error before reloading.
- Reload without dropping existing connections:
sudo systemctl reload nginxUse the service manager appropriate to your operating system if the unit has a different name.
- Confirm that Nginx is listening on both ports:
sudo ss -ltnp | grep -E ':(80|443)b' - Make a header request to both schemes and hosts:
curl -I http://example.com/health-check curl -I https://example.com/health-checkThe HTTP request should return the planned redirect. The HTTPS request should complete the TLS handshake and return your WordPress response, commonly
200,301, or an application-level response for that path.
If nginx -t names a line in an included file, inspect the path and permissions shown in the error rather than editing an unrelated virtual host. A configuration can be syntactically valid yet still serve the wrong certificate if another server block is the default for that IP address and hostname.
Tell WordPress that the canonical site is HTTPS
WordPress is fully compatible with HTTPS when a TLS/SSL certificate is installed and available for the web server. It still needs its own site and home URLs changed so generated links, forms, feeds, and redirects use the secure scheme.
Use the WordPress administration screen
- Sign in to the administrator dashboard over HTTPS.
- Open Settings → General.
- Change both WordPress Address (URL) and Site Address (URL) from
http://tohttps://, keeping the exact canonical hostname chosen in Nginx. - Save the changes, sign in again if WordPress ends the session, and open a front-end page in a new private window.
Do not change only one of the two URL fields. A mismatch can produce admin redirects, links to the wrong scheme, or a site that appears partly migrated.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Lock the URLs in configuration when the dashboard is unavailable
If a redirect loop prevents access to the dashboard, define the values in wp-config.php before the line that says to stop editing:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Use the same hostname and path as the Nginx configuration. These constants override the database values for runtime use; remove or update them later if you want administrators to manage the URLs from the dashboard.
Account for a TLS-terminating proxy
When a CDN, load balancer, or reverse proxy terminates TLS before forwarding requests to Nginx, the origin may receive plain HTTP even though the visitor used HTTPS. In that topology, configure the proxy to send its documented HTTPS indicator and configure Nginx or WordPress to trust it only from the proxy’s network. A generic unconditional “trust any forwarded HTTPS header” rule lets a client spoof the scheme and is unsafe.
Also ensure the proxy forwards the original host. If Nginx sees an internal hostname while WordPress is configured for the public hostname, canonical redirects can bounce between the two addresses.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify the complete WordPress migration
- Open the home page, a post, a category archive, search, the login screen, and
/wp-admin/over HTTPS. - Inspect the browser address bar and developer-tools Network panel for requests still using
http://. - Check images, stylesheets, JavaScript, web fonts, embeds, favicon files, XML sitemaps, feeds, and downloadable media.
- View page source and confirm canonical, Open Graph, and alternate URLs use the chosen HTTPS hostname.
- Submit a form and test authenticated cookies. A secure page should not load a login form or account resource over plain HTTP.
- Use an external TLS checker or a second browser network to confirm that the served chain contains the leaf and required intermediates.
Replacing stored content URLs is a separate WordPress data task. Back up the database before changing serialized settings, and use a tool that understands serialized PHP data rather than running an unqualified text replacement. A redirect can hide an old URL in casual browsing while scripts, APIs, or security policies still report mixed content.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Troubleshoot the errors that appear most often
“Private key does not match certificate”
First verify that the key was generated for the CSR used by the certificate. Then check that ssl_certificate points to a file whose first certificate is the leaf. If you concatenated the bundle first, Nginx may compare the key against the bundle’s first certificate and report a mismatch. Rebuild the file in this order:
cat example.com.crt bundle.crt > example.com.chained.crtDo not use a key from a previous renewal or from a different hostname. The public-key comparison shown earlier identifies this problem before a reload.
Browsers report an incomplete chain
Browsers may trust the issuing authority but still lack an intermediate certificate. Confirm that every intermediate supplied by the issuer is appended after the leaf in the file named by ssl_certificate. Do not substitute the private key or an unrelated root certificate. After reloading, inspect the certificates actually sent by the public endpoint, not only the files on disk.
Nginx cannot read the key
Check the path, ownership, mode bits, parent-directory traversal permissions, and any SELinux or AppArmor denial. The Nginx master process needs to read the key at startup or reload. Keep the key restricted; changing it to mode 644 is not a proper fix. If a deployment tool writes new files on renewal, make it preserve the owner and mode on every replacement.
Free tools Windows power users keep installed
One-click scans. No signup required.
The site redirects repeatedly
Look for two independent redirect decisions: the Nginx HTTP-to-HTTPS rule and WordPress’s canonical URL logic. In a proxy deployment, verify that the proxy’s HTTPS header reaches WordPress and that only trusted proxy addresses are accepted. Also compare the exact host, port, and path in the proxy, Nginx server_name, WP_HOME, and WP_SITEURL. A loop often means one layer believes the request is HTTP or uses a different canonical hostname.
The page is HTTPS but shows mixed-content warnings
Find the specific insecure URLs in the browser console. Update theme, plugin, widget, image, stylesheet, script, and media references to HTTPS, then clear page caches. A server redirect does not rewrite an insecure subresource before the browser blocks or upgrades it. If an external resource has no HTTPS endpoint, replace it or remove it rather than weakening browser security.
The wrong certificate appears
Ensure the requested hostname is listed in the certificate SAN and in the intended HTTPS server_name. Check for duplicate port-443 blocks, an unintended default server, an IPv6 listener pointing to another configuration, or a load balancer serving its own certificate. Test each public IP and both IPv4 and IPv6 paths when DNS publishes both.
An old configuration uses ssl on;
Replace the obsolete standalone directive with listen 443 ssl;. The old form was deprecated in Nginx 1.15.0 and removed in 1.25.1. Leaving it in a newer installation can cause a configuration error before Nginx reads the certificate settings.
Plan renewals instead of repeating a manual emergency install
A certificate’s expiration date is independent of the Nginx package version. Record the renewal deadline and the names covered by each certificate. Obtain the replacement leaf, bundle, and key according to the issuer’s process, build a new chained file with the leaf first, apply the same ownership and modes, run nginx -t, and reload only after the test succeeds.
Keep the old certificate and key outside the active path until the new endpoint has been verified, but do not leave unnecessary private keys indefinitely. If automation replaces a symlink target, make sure the Nginx master can read the new target and that the reload is part of the deployment. Monitor both expiration and chain delivery; a certificate can be within its validity dates while clients still fail because an intermediate was omitted.
Deployment choices that change the procedure
| Topology | Where TLS terminates | Required decisions |
|---|---|---|
| Direct Nginx | Nginx on the WordPress server | Install the chain and key locally, listen on 443, and redirect port 80. |
| Reverse proxy or CDN in front | Proxy, with optional TLS again from proxy to Nginx | Install a certificate at the public edge; install an origin certificate on Nginx if the proxy uses HTTPS to the origin. Preserve the original host and securely handle the forwarded HTTPS indicator. |
| Multiple Nginx nodes | Each node or a shared edge | Distribute the same hostname coverage and chain to every TLS terminator, protect each private key, and coordinate reloads so nodes do not present different expiry dates. |
Do not assume that a certificate installed on an origin server secures the public connection if a proxy terminates TLS first. Conversely, encrypting only the visitor-to-proxy hop leaves a plain origin hop unless the proxy-to-Nginx connection is separately protected.
Quick Recap
Final installation checklist
- The certificate covers the canonical hostname and every hostname intentionally served.
- The chained file contains the leaf certificate first, followed by the issuer’s intermediate certificates.
ssl_certificatepoints to that chained file;ssl_certificate_keypoints to the matching private key.- The key is outside the web root, restricted to the Nginx master and administrators, and readable after a renewal replacement.
- The HTTPS block uses
listen 443 ssl;and a current protocol policy appropriate to the installed Nginx/OpenSSL build. - The HTTP block redirects to one canonical HTTPS hostname without creating a loop.
nginx -tsucceeds before every reload.- Both WordPress URL settings use the same HTTPS hostname, and proxy headers are trusted only in the topology that supplies them.
- Login, administration, media, canonical URLs, and externally loaded assets complete without mixed-content or certificate-chain warnings.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
