The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →To put app.example.com on an Nginx server, configure two independent pieces: DNS must resolve the hostname to the correct infrastructure, and Nginx must match that hostname with a dedicated server block. The block can serve files from a new document root or proxy requests to an application listening on a local port. After HTTP routing works, issue a certificate for the exact hostname, add a TLS listener on port 443, test the configuration, and reload Nginx.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The sequence below works for a self-managed Linux server. DNS control panels, Linux paths, firewall tools, and service managers differ by provider, so treat distribution-specific commands as examples and verify their output on your host.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat a subdomain setup actually involves
A subdomain is a hostname such as app.example.com. DNS does not install a website or choose an Nginx configuration; it only directs the hostname toward an address or provider target. Once a request reaches your server, Nginx examines the listening address and port and then the HTTP Host header. Its server_name rules select the virtual server that handles the request. As Nginx documentation puts it, “Server names are defined using the server_name directive and determine which server block is used for a given request.”
This separation explains common failures. A correct DNS record with no matching server block usually lands on a default site. A perfect server block cannot help if the hostname resolves to another machine. HTTPS adds a third requirement: the certificate presented on port 443 must cover the exact hostname the browser requests.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Before you begin
- Control of the DNS zone for
example.com. - The server’s public IPv4 address, and its IPv6 address if you intend to publish an
AAAArecord. - Administrative access sufficient to create Nginx configuration files, run
nginx -t, and reload the service. - A decision about whether the subdomain serves static files or forwards to an application process.
- Inbound access to port 80 for ordinary HTTP and, when used, HTTP-01 certificate validation; port 443 is required for HTTPS traffic.
Choose the final spelling before configuring anything. app.example.com, www.app.example.com, and api.example.com are different names for DNS, Nginx matching, certificates, cookies, and redirects.
Step 1: Create the DNS record
Point the name directly at the server
At your DNS provider, add an A record whose name is app (or the provider’s equivalent) and whose value is the server’s public IPv4 address. The resulting fully qualified name is app.example.com. If the server is reachable over IPv6, add an AAAA record with the IPv6 address. Publish only addresses that actually accept traffic for this service; an incorrect AAAA record can make IPv6 clients fail even when IPv4 works.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use a CNAME when another provider hosts the service
If the application is hosted by a platform rather than your Nginx machine, use the target prescribed by that platform. A CNAME can point app.example.com to another hostname, where the provider controls the final addresses. Do not replace a provider’s documented target with your server’s IP, and remember that a CNAME is not used at the zone apex in the same way as an ordinary host record.
Check propagation from the deployment environment
DNS caches do not update everywhere at once. Query the name from the server or another network before blaming Nginx:
dig +short app.example.com A
dig +short app.example.com AAAA
# or, on systems without dig:
nslookup app.example.comThe returned address should be the machine that will receive the request. If the result is empty or points elsewhere, check the record name, nameservers delegated for example.com, spelling, and any conflicting record at the provider. Wait for the record’s cache lifetime to expire before assuming every resolver has updated.
Step 2: Choose static files or a reverse proxy
Static site
Use a static configuration when Nginx should read HTML, CSS, JavaScript, images, or other files directly from disk. You need a document root, an index file, and permissions that allow the Nginx worker to read the content.
Application behind Nginx
Use a reverse proxy when a process such as a web application listens on a local TCP port or Unix socket. Nginx accepts the public request, forwards it with proxy_pass, and returns the upstream response. The correct upstream address, path behavior, and headers depend on the application; confirm those requirements with its documentation. Nginx cannot produce a useful response if the process is stopped or listening on a different address.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Step 3: Create an Nginx server block
Minimal static configuration
Create a site file in the configuration directory used by your distribution. The following block listens on IPv4 and IPv6 port 80 and matches only the requested hostname:
server {
listen 80;
listen [::]:80;
server_name app.example.com;
root /var/www/app;
index index.html;
}Create the root directory and place an index.html there. The path is an example; use the directory where your deployment actually stores the site. Keep the exact name in server_name. Nginx’s matching process uses the request’s listener and Host header, so a typo here can send traffic to another virtual server.
Reverse-proxy configuration
For an application listening on local port 3000, the server block commonly has this shape:
server {
listen 80;
listen [::]:80;
server_name app.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}The port and headers are examples, not universal requirements. Change proxy_pass to the address on which your process is actually listening. Some frameworks need a particular base path, WebSocket upgrade headers, or a Unix socket instead; add those only when the application calls for them. If the upstream is bound only to a private interface, ensure Nginx can reach that interface.
Understand the directives that matter
listenidentifies the local address and port for the virtual server. A block on port 80 does not receive HTTPS traffic arriving on 443.server_namelists the hostnames this block can match. An exact name is the least surprising choice for one subdomain.rootmaps URL paths to files for static serving;indexsupplies the default file for a directory request.locationchooses request handling. A proxy location forwards to an upstream instead of looking for a local file.
Step 4: Enable, test, and reload
Enable the file using your distribution’s layout
Many Debian-derived installations keep site definitions in /etc/nginx/sites-available and activate them with a symbolic link in /etc/nginx/sites-enabled. A typical example is:
sudo ln -s /etc/nginx/sites-available/app.example.com /etc/nginx/sites-enabled/app.example.comOther distributions load files from /etc/nginx/conf.d or an included directory and do not use these symlinks. Inspect the include directives in the main Nginx configuration and follow that layout rather than creating a directory Nginx never reads.
Validate before touching live workers
Run the configuration test with appropriate privileges:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo nginx -tProceed only when the command reports that syntax is valid and the test succeeded. Errors identify the file and line that must be corrected. Frequent causes include a missing semicolon, a certificate path that does not exist, a duplicate directive in the wrong context, or a file that is not included.
Reload without dropping connections
Use the service manager supplied by the operating system. On systems using systemd, the usual command is:
sudo systemctl reload nginxThen inspect the service status and error log if the reload fails. A reload asks existing workers to finish while new workers use the validated configuration; do not claim the change is live until the service manager confirms it.
Step 5: Verify HTTP routing
Test the public hostname rather than only requesting 127.0.0.1. First check the response headers:
curl -I http://app.example.comFor a static site, request a known file and confirm the content comes from /var/www/app. For a proxy, check that the application responds and that its logs record the request. A temporary marker file or distinctive response can help distinguish the new root from the main site’s root.
When DNS is still propagating, you can test a server directly while supplying the intended host header:
curl -I -H 'Host: app.example.com' http://SERVER_IPThis tests Nginx’s name selection but does not prove that public DNS or HTTPS is correct. Replace SERVER_IP with the address that the DNS record should return. Nginx documentation describes this behavior explicitly: “In this configuration nginx tests only the request’s header field ‘Host’ to determine which server the request should be routed to.”
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Step 6: Add HTTPS for the subdomain
Prepare DNS and firewall access
Before requesting a certificate, make sure app.example.com resolves to the validation server. Allow inbound port 80 when using HTTP-01 validation and port 443 for the finished HTTPS service. The ACME challenge is fetched from a path under /.well-known/acme-challenge; a redirect, access rule, proxy, or firewall that blocks that path can prevent issuance.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use Certbot’s Nginx integration
Install Certbot using the package method supported by your operating system, back up the Nginx configuration, and request the exact hostname. A representative invocation is:
sudo certbot --nginx -d app.example.comCertbot can obtain a certificate and modify supported Nginx configurations. Review every proposed change, and keep the backup so you can restore the previous file if the automated edit is unsuitable. The command and options supplied by your distribution may differ.
Understand the resulting TLS server block
An HTTPS virtual server needs a 443 listener, the same exact hostname, and certificate and key files whose subject alternative names cover that hostname:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name app.example.com;
ssl_certificate /etc/letsencrypt/live/app.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
root /var/www/app;
index index.html;
}For a proxied application, retain the same location and proxy_pass directives inside this 443 block. The fullchain.pem path supplies the server certificate and intermediate chain; the private-key path must be readable by Nginx under the permissions established by your certificate tooling. Do not copy a certificate for example.com and assume it automatically covers every subdomain: verify the certificate’s names.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Keep port 80 available for HTTP-01
ACME clients using HTTP-01 need to reach port 80 on the validation host. Nginx’s ACME guidance keeps a port-80 listener specifically for that purpose. You may redirect ordinary HTTP requests to HTTPS, but ensure the challenge location remains reachable and is not redirected or denied in a way the validator cannot follow. After editing, run nginx -t, reload, and open https://app.example.com in a browser or with curl -I.
Check renewal instead of assuming it
Certificate issuance and renewal are separate operations. Certbot normally installs a scheduled renewal mechanism, but its presence does not prove a future renewal will succeed. Run the renewal test command supplied by your installation, inspect its output, and correct DNS, port, permission, or challenge-path problems before the certificate approaches expiration.
Exact names, wildcards, and certificates
Exact hostname matching
Use server_name app.example.com; when one block should answer one subdomain. This makes accidental matches easier to detect and limits the effect of configuration mistakes.
Wildcard server names
A pattern such as *.example.com can cover multiple one-level hostnames. Nginx applies defined priorities among exact, wildcard, and regular-expression names; overlapping blocks can therefore produce surprising results. Keep overlapping patterns to a minimum and test each hostname.
Wildcard DNS and wildcard certificates are different
A wildcard DNS record controls where names resolve. A wildcard certificate controls which names a TLS certificate can authenticate. Configuring one does not configure the other. A wildcard certificate may also require a DNS-based ACME challenge rather than HTTP-01, depending on the certificate authority and client workflow. Choose the challenge method deliberately and verify every name you intend to serve.
Troubleshooting by symptom
| Symptom | Checks and corrective action |
|---|---|
| DNS lookup fails or returns no address | Confirm the A, AAAA, or CNAME record, delegated nameservers, provider target, and spelling. Query from the deployment environment and allow for resolver caching. |
| The main site appears | Inspect the request’s Host header, duplicate or wildcard server_name entries, the listening port and address, and whether the new file is actually included or enabled. Nginx chooses a server using listener and name-selection rules. |
| 404 from the new hostname | For static content, check root, the requested path, index filename, and read permissions. For a proxy, confirm the request is entering the intended location and is not being handled as a local file. |
| 502 Bad Gateway | Confirm that the upstream process is running and listening at the exact proxy_pass address. Check local firewall rules, Unix-socket ownership and mode, and the Nginx error log. |
| Certificate warning | Inspect the certificate’s subject alternative names, confirm the browser hostname is exactly covered, verify that the 443 block points to the matching certificate and key, and install the complete chain where required. |
| ACME challenge failure | Resolve the hostname to the validation server, make port 80 reachable, and ensure /.well-known/acme-challenge is not blocked, served from the wrong root, or redirected in a way the client cannot follow. |
Logs and targeted diagnostics
When behavior differs from the configuration, look at evidence from the request path rather than changing several directives at once. Check Nginx’s error log for upstream connection errors, permission failures, certificate loading errors, and configuration reload messages. Check the application log for requests that reached the upstream. Compare these observations:
digornslookupconfirms the public name and address.curl -H 'Host: app.example.com' http://SERVER_IPconfirms Nginx name matching independent of DNS.curl -I https://app.example.comconfirms the public TLS listener, certificate presentation, and HTTP response.- A direct request to the upstream’s local port confirms whether the application itself is healthy, when that port is intentionally reachable for testing.
Restore the last known-good configuration if a change causes an outage. Keep a dated backup before automated certificate edits and validate every restored file with nginx -t before reloading.
Operational checklist
- DNS records point to the intended server or documented provider target, including deliberate IPv6 behavior.
- The exact hostname appears in the correct enabled Nginx file.
- The chosen root or upstream is reachable by Nginx and has appropriate permissions.
- Port 80 and port 443 are allowed where the service and certificate challenge require them.
nginx -tsucceeds before every reload.- HTTP and HTTPS requests are tested using the public hostname, not only an IP address.
- The certificate SAN list includes the exact subdomain and the complete chain is configured.
- Renewal testing has been performed rather than inferred from successful first issuance.
- Logs are monitored after deployment so a wrong-site response, 404, 502, or TLS error can be tied to a specific layer.
When managed hosting changes the procedure
On managed DNS, VPS, or web-hosting platforms, you may not control the authoritative nameservers, firewall, certificate store, or Nginx master configuration. The conceptual split remains the same, but the provider may expose DNS records and HTTPS settings in a dashboard instead of files and commands. Use the provider’s documented CNAME target, certificate workflow, and deployment path; do not create an Nginx block on a machine that never receives the hostname’s traffic.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
