Free tools Windows power users keep installed
One-click scans. No signup required.
Move an SSL certificate by transferring the leaf certificate, private key, and any intermediate chain over an encrypted administrative connection; store them with restrictive permissions; point the correct Apache <VirtualHost *:443> at those files; then test and reload Apache. If Certbot manages the certificate, keep Apache pointed at /etc/letsencrypt/live/<certificate-name>/fullchain.pem and privkey.pem so renewals continue to work.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What must move, and what can stay behind
An HTTPS deployment consists of more than one file. The server needs the certificate for the hostname, the corresponding private key, and usually one or more intermediate certificates that allow browsers to build a trusted chain to a root certificate. A migration is complete only when all required pieces are on the new VPS and Apache serves them for the intended hostname.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Leaf certificate: identifies the site and contains its public key.
- Private key: proves that Apache is authorized to use the certificate. Treat it as secret; anyone who obtains it can impersonate the site until the certificate is revoked or expires.
- Intermediate chain: certificates supplied by the issuing authority. A browser may reject a server that sends only the leaf certificate.
- Apache configuration: the SSL virtual host that selects the certificate files for requests on port 443.
- Renewal configuration: required when the certificate is managed by Certbot or another automated client.
Do not copy an old certificate blindly. First check that its subject or Subject Alternative Name (SAN) entries cover every hostname served by the destination virtual host, such as both the apex domain and its www alias. Also determine whether the old server used a single full-chain file or separate certificate and chain files; that affects the Apache directives you will set.
Choose the migration path
The safest configuration depends on who will renew the certificate after the move. A manually issued certificate can be copied as-is, but you must arrange future renewals yourself. A Certbot-managed certificate should normally be installed from Certbot’s live directory rather than copied from a dated archive.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Characteristic | Manual certificate installation | Certbot-integrated installation |
|---|---|---|
| Who renews it | You or the certificate issuer’s separate process; no automatic renewal is implied. | Certbot’s renewal timer or a manually scheduled certbot renew run. |
| Apache editing | You edit the SSL virtual host and select every file path. | The Apache plugin can find the matching virtual host, add TLS directives, and reload Apache. |
| Typical files | Files copied to locations such as /etc/ssl/certs/ and /etc/ssl/private/. |
/etc/letsencrypt/live/<certificate-name>/fullchain.pem and privkey.pem, which track the current certificate through symlinks. |
| Reload after renewal | You must configure a deploy hook or equivalent reload action. | The Apache installation flow configures an automatic reload; verify it on the new VPS. |
| Validation options | Whatever method your issuer supports. | HTTP-01 needs DNS pointing to the VPS and reachable port 80; DNS validation is an alternative when port 80 cannot be exposed. |
| Key access | Set ownership and modes so only root and the required Apache group can read the key. | Certbot applies restrictive defaults; adjust group access only when Apache’s privilege model requires it. |
Before you copy anything
Inventory the old server
Log in to the old host through an authenticated administrative account and locate the active certificate, key, chain, and virtual-host file. Inspect the Apache configuration to see the exact directives currently in use. A certificate may be stored under a custom directory, while the key may be outside the web root. Never place a private key in a document directory or a source-control repository.
Record the certificate’s expiration date, issuer, subject, and SAN names. If the old server uses a combined file, identify whether it starts with the leaf certificate followed by intermediate certificates. Keep the original files untouched until the new endpoint has passed an external HTTPS check.
Recommended Free Tools
Confirm the destination prerequisites
- An Ubuntu VPS with Apache installed and administrative access through
sudo. - DNS records that will point the service hostname to the new VPS when you cut over.
- Firewall and cloud rules allowing TCP 443. Allow TCP 80 as well if you will use HTTP-01 validation or redirect HTTP to HTTPS.
- The Apache SSL module and a site configuration for the intended hostname.
- A secure way to transfer files, such as an authenticated
scpsession over SSH.
Synchronize the cutover plan with DNS time-to-live settings and keep the old server available during verification. Existing clients may continue reaching the old address until DNS caches expire.
Transfer and store a certificate obtained outside Certbot
1. Transfer over an encrypted administrative channel
Use an authenticated, encrypted transfer from the old host or your administrative workstation. For example, copy files to a temporary directory owned by root on the destination, then move them into their final locations:
scp example.com.crt admin@NEW_SERVER:/tmp/Repeat for the private key and chain only if your issuer supplies them as separate files. Remove temporary copies immediately after installation. Do not paste key contents into chat, tickets, shell history, or commands that expose them to other users.
2. Use conventional protected directories
Ubuntu commonly uses /etc/ssl/certs/ for certificates and /etc/ssl/private/ for private keys. The Apache directives can reference another root-owned directory, but a predictable layout makes audits and troubleshooting easier. Give files descriptive names that identify the hostname without embedding secrets.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo install -o root -g root -m 0644 example.com.crt /etc/ssl/certs/example.com.crt
sudo install -o root -g root -m 0600 example.com.key /etc/ssl/private/example.com.key
sudo install -o root -g root -m 0644 intermediate-chain.pem /etc/ssl/certs/example.com-chain.pemThe exact key mode depends on how Apache starts and drops privileges. On Ubuntu, Apache normally begins with root privileges and worker processes run as a service account. If workers must open the key directly, use a dedicated group and a mode such as 0640, then verify directory traversal permissions; never make the key world-readable. Check the effective group in the Apache configuration and confirm access with a non-destructive file-permission test.
3. Assemble a full-chain file when required
Modern Apache versions normally receive the leaf certificate followed by its intermediate certificates in SSLCertificateFile. If your issuer provided a leaf file and a chain file separately, create a combined file in that order:
sudo sh -c 'cat /etc/ssl/certs/example.com.crt /etc/ssl/certs/example.com-chain.pem > /etc/ssl/certs/example.com-fullchain.pem'
sudo chown root:root /etc/ssl/certs/example.com-fullchain.pem
sudo chmod 0644 /etc/ssl/certs/example.com-fullchain.pemDo not append the private key to this file. Older Apache releases may use a separate chain directive; follow the syntax supported by the version installed on your VPS rather than copying directives from an unrelated server.
Configure Apache’s SSL virtual host
Enable TLS support and the intended site
Enable the SSL module and the site configuration that should answer for the hostname:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo a2enmod ssl
sudo a2ensite your-site-ssl.confUbuntu’s packaged default SSL site can be enabled with sudo a2ensite default-ssl, but a named virtual host is preferable for a production domain. Site files normally live in /etc/apache2/sites-available/; enabled sites are represented in /etc/apache2/sites-enabled/. Make sure the file you edit is the one Apache actually includes.
Edit the matching port-443 block
Open the SSL virtual-host file and verify its ServerName and ServerAlias values. Then set certificate directives inside the matching <VirtualHost *:443> block:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/example.com
SSLEngine on
SSLCertificateFile /etc/ssl/certs/example.com-fullchain.pem
SSLCertificateKeyFile /etc/ssl/private/example.com.key
# Other proxy, rewrite, and logging directives belong here.
</VirtualHost>For a certificate whose chain is configured separately on an older Apache version, use the issuer’s intermediate file with the chain directive supported by that release. For current Apache, prefer one full-chain file in SSLCertificateFile; sending only the leaf is a common cause of “incomplete chain” warnings.
Check that the certificate and key belong together
Before reloading, compare the public-key fingerprints derived from the certificate and private key. The exact OpenSSL commands vary with key type, but this pattern works for common RSA and modern EC keys:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →openssl x509 -in /etc/ssl/certs/example.com-fullchain.pem -pubkey -noout | openssl pkey -pubin -outform der | sha256sum
openssl pkey -in /etc/ssl/private/example.com.key -pubout | openssl pkey -pubin -outform der | sha256sumThe hashes must match. If they do not, stop and locate the key that was originally generated with the certificate. Do not attempt to “fix” a mismatch by editing either file.
Validate and reload Apache safely
- Run
sudo apachectl configtest. On a healthy configuration it reportsSyntax OK. Correct every path, permission, unknown-directive, or module error before proceeding. - Inspect the system journal if the test reports a key-read or certificate-parse failure. A typo in a symlink target, an unreadable parent directory, or a certificate in the wrong PEM format is more likely than an Apache bug.
- Reload without dropping existing connections:
sudo systemctl reload apache2. Use a full restart only when the distribution or a specific configuration change requires it. - Check that Apache is listening on 443 and that the expected virtual host is enabled. If multiple SSL sites exist, confirm their ordering and hostname matching.
- From a separate network, open the exact hostname over HTTPS. Inspect the served subject, SAN names, issuer, chain, and expiration date. Test both the apex and alias names you intend to publish.
Keep the old certificate and configuration backup until this external check succeeds. If the new service fails, restore the previous directive paths, run apachectl configtest again, and reload Apache before investigating a second change.
Move a Certbot-managed certificate
Identify the certificate name
On the source or destination host, run:
sudo certbot certificatesNote the certificate name and every domain listed. Certbot normally stores the active references under /etc/letsencrypt/live/<certificate-name>/. That directory contains links to versioned files in an archive directory. The links are deliberately stable while the target files change after renewal.
Point Apache at the live paths
Use the full chain and private key files directly in the SSL virtual host:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pemfullchain.pem contains the server certificate followed by the intermediate certificates. privkey.pem contains the private key. Do not replace these paths with a dated file from the archive; doing so leaves Apache serving an old certificate after a successful renewal.
Certbot’s Apache plugin searches for the virtual host matching the requested domains, inserts the necessary TLS directives, and reloads Apache. To obtain and install a new certificate on the VPS, the integrated flow is:
sudo certbot --apache -d example.com -d www.example.comIf you want Certbot to obtain or renew files without changing Apache configuration, use the certificate-only flow and set the virtual-host directives yourself:
sudo certbot certonly --apache -d example.com -d www.example.comChoose the mode deliberately. The plugin is convenient when Apache’s configuration is conventional; a manual virtual host gives you tighter control when the site is behind a proxy, uses unusual rewrites, or must not be edited automatically.
Preserve renewal after the move
Run a dry renewal test before decommissioning the old VPS:
sudo certbot renew --dry-runThis exercises the renewal configuration without replacing a live certificate. Confirm that DNS resolves the validation names to the new VPS, that port 80 is reachable for HTTP-01, and that Apache can be reloaded after a successful renewal. Ubuntu installations commonly use a systemd timer for renewal, and certificates installed through the Apache plugin are normally followed by an Apache reload. Verify the timer and its logs rather than assuming they were transferred with the certificate files.
For a manually configured Apache service, add a Certbot deploy hook that reloads Apache only after a renewal succeeds. A reload hook prevents an updated file on disk from remaining unused in the running process.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteCertificate validation methods and DNS cutover
HTTP-01 validation
HTTP-01 requires the requested hostname to resolve to the VPS and port 80 to accept the validation request. A firewall rule, security group, reverse proxy, or permanent redirect that blocks the challenge path can cause issuance or renewal to fail. During a migration, lower DNS TTL ahead of time, switch the A or AAAA record, and verify that both IPv4 and IPv6 addresses reach the new server if both records exist.
DNS validation
Use DNS validation when the service cannot expose port 80, when a firewall policy forbids it, or when a wildcard certificate is needed. The validation client creates a DNS record; issuance waits for that record to propagate. Ensure the account or automation responsible for DNS can still update the correct zone after the move.
Security checks that prevent key exposure
- Keep private keys outside web roots and backups that are readable by ordinary users.
- Remove temporary copies from
/tmpand transfer staging directories after installation. - Use root ownership and the narrowest group and mode that let Apache read the key.
- Inspect parent-directory permissions; a restrictive file is ineffective if every user can traverse a directory containing an unprotected copy.
- Review mandatory-access-control logs if AppArmor or another policy denies Apache access. Adjust the policy or move the file to an approved directory instead of making the key public.
- Protect backups with the same care as live keys and record who can restore them.
- If a key may have been disclosed, ask the issuer to revoke the certificate and issue a replacement rather than merely changing Apache paths.
Troubleshooting by symptom
Apache cannot read the private key
Check the path in SSLCertificateKeyFile, ownership, file mode, group membership, and execute permission on every parent directory. Read the Apache error log and system journal for permission or policy denials. Grant access to the required service group with a mode such as 0640 only when necessary; never solve the problem with chmod 777 or a world-readable key.
Browsers report an incomplete chain
Inspect the file configured in SSLCertificateFile. It should contain the leaf certificate followed by the issuer’s intermediate certificates, or the separate chain directive must point to the correct intermediate file on an older Apache release. Rebuild the full-chain file if the order is wrong, then run the syntax test and reload.
The wrong certificate is served
Multiple enabled virtual hosts may match the same request. Verify ServerName, ServerAlias, the enabled-site links, and the hostname used in your test. Test the exact DNS name over port 443 rather than an IP address, because Apache selects a certificate using the TLS server name indication supplied by the client.
Renewal succeeds but the old certificate remains live
Check that Apache references the Certbot live paths, not an archive filename, and confirm that the post-renewal reload runs successfully. A dry-run renewal followed by a journal review usually reveals whether the timer, hook, or reload step is missing.
Certbot cannot complete HTTP validation
Confirm that DNS has finished pointing to the new VPS, port 80 is reachable from the public internet, and another web server or firewall is not intercepting the challenge URL. If the deployment cannot expose port 80, switch to DNS validation and ensure the DNS automation can publish the required record.
Quick Recap
Final migration checklist
- The certificate covers every production hostname in the SSL virtual host.
- The matching private key was transferred through an encrypted channel and is not exposed in logs or chat.
- The full chain is configured, either in
SSLCertificateFileor through the chain mechanism supported by the installed Apache version. - Key ownership, group access, file modes, and parent-directory permissions allow Apache to read the key without exposing it to other users.
sudo apachectl configtestreturnsSyntax OKbefore every reload.- The exact HTTPS hostname serves the expected certificate, chain, and expiration date from the new VPS.
- Certbot deployments use
/etc/letsencrypt/live/<certificate-name>/paths, andsudo certbot renew --dry-runcompletes successfully. - The old configuration remains available until DNS propagation and external HTTPS checks are complete.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
