What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Set up one Nginx server block for each subdomain, point each block’s proxy_pass at the correct backend, and issue a certificate for every exact hostname with Certbot’s Nginx plugin. Leave port 80 available for the ACME challenge, test the configuration with nginx -t, then reload Nginx. The result is HTTPS at each subdomain while your applications continue listening on private local ports.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the finished setup looks like
Assume a server hosts three applications:
| Hostname | Backend address | Public protocol |
|---|---|---|
app1.example.com |
127.0.0.1:3001 |
HTTPS on port 443 |
api.example.com |
127.0.0.1:4000 |
HTTPS on port 443 |
dashboard.example.com |
127.0.0.1:5000 |
HTTPS on port 443 |
Nginx receives the request, selects the matching server_name, terminates TLS, and forwards the request to that subdomain’s private service. The applications do not need their own publicly trusted certificates when the connection between Nginx and the application stays on the same machine or a trusted private network.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsUse a separate server block per subdomain rather than trying to route unrelated applications from one block with a long collection of conditional statements. Separate blocks make certificates, logs, redirects, limits and backend ports easier to audit.
Prerequisites and decisions
DNS must point to this server
Create an A record for every IPv4 hostname and an AAAA record only when the server is correctly reachable over IPv6. For example, app1.example.com must resolve to the public address of the Nginx host before HTTP certificate validation can succeed. Check each name from a network outside the server:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
dig +short app1.example.com
dig +short api.example.comIf a stale AAAA record points elsewhere, some certificate authorities will reach that address instead of your server. Remove the record or make the IPv6 service work before requesting the certificate.
Open the required ports
- Allow TCP port 80 for the ACME HTTP challenge and HTTP-to-HTTPS redirects.
- Allow TCP port 443 for encrypted client traffic.
- Keep application ports such as 3001, 4000 and 5000 private whenever possible; bind them to
127.0.0.1or a protected internal interface.
Confirm the software and service layout
- Install Nginx and confirm it can start under your distribution’s service manager.
- Install Certbot and its Nginx plugin. Check the installed version with
certbot --version; package versions differ between distributions. - Verify each backend responds locally before adding the proxy:
curl -I http://127.0.0.1:3001
curl -I http://127.0.0.1:4000A backend that is down, bound only to an unreachable address, or expecting a different protocol will produce gateway errors even when the TLS configuration is perfect.
Free tools Windows power users keep installed
One-click scans. No signup required.
How proxy_pass chooses the upstream
The directive has the form proxy_pass URL; and is valid inside a location. The URL specifies an http or https upstream, a domain name or IP address, an optional port, and optionally a URI path.
| Configuration | Request to Nginx | Path sent upstream |
|---|---|---|
location / { proxy_pass http://127.0.0.1:3001; } |
/orders/7 |
/orders/7 |
location /api/ { proxy_pass http://127.0.0.1:4000/; } |
/api/orders/7 |
/orders/7 |
location /api/ { proxy_pass http://127.0.0.1:4000/v1/; } |
/api/orders/7 |
/v1/orders/7 |
When the proxy_pass value includes a URI, Nginx replaces the part of the request URI that matched the location. Omitting the URI preserves the original request path. A trailing slash therefore matters; decide deliberately whether your application expects /api/orders or /orders.
If an upstream name resolves to multiple addresses, Nginx can use those addresses in round-robin order. For a single local application, an IP and port are usually clearer. Use https:// in proxy_pass only when the upstream itself speaks TLS and has a certificate and trust arrangement that Nginx can use.
Create the initial HTTP configuration
Start with an HTTP server block. Certbot’s HTTP-01 validation must be able to fetch a token over port 80, so do not begin with a blanket rule that blocks every HTTP request. The challenge location below serves files from /var/www/certbot; create that directory and ensure the Nginx worker can read it.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo mkdir -p /var/www/certbot
sudo chown -R www-data:www-data /var/www/certbotOn distributions that run Nginx as another user, use that account instead of www-data. Add a file such as /etc/nginx/sites-available/app1.example.com:
server {
listen 80;
server_name app1.example.com;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
return 301 https://$host$request_uri;
}
}Enable the site using your distribution’s normal symlink or include mechanism. If your system uses the Debian-style layout:
sudo ln -s /etc/nginx/sites-available/app1.example.com /etc/nginx/sites-enabled/app1.example.com
sudo nginx -t
sudo systemctl reload nginxRepeat the HTTP block for each hostname, changing only server_name (and the filename). You can also place multiple names in one block when they are intentionally covered by the same certificate and backend, but unrelated applications should remain separate.
Request and install the certificate with Certbot
Back up Nginx configuration before allowing an automated tool to edit it:
Recommended Free Tools
sudo cp -a /etc/nginx /etc/nginx.backup.$(date +%Y%m%d-%H%M%S)Request a certificate for one exact subdomain:
sudo certbot --nginx -d app1.example.comThe --nginx plugin performs two related jobs: it proves control of the domain and obtains a certificate, then it can edit the Nginx configuration to install the certificate and create an HTTP-to-HTTPS redirect. Certbot normally stores the live certificate symlinks below /etc/letsencrypt/live/app1.example.com/. Repeat the command with the exact name for every subdomain, for example:
sudo certbot --nginx -d api.example.com
sudo certbot --nginx -d dashboard.example.comRead Certbot’s proposed changes and choose the redirect option when prompted if all ordinary HTTP traffic should move to HTTPS. If an automated edit produces an unwanted result, restore the backup or use Certbot’s rollback facility:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo certbot --nginx rollbackA certificate obtained through the manual authentication plugin and later installed with the Nginx plugin does not automatically renew. Use an automated authenticator such as the Nginx plugin, or provide a renewal hook and authentication process that can run unattended.
Build the HTTPS reverse-proxy block
After issuance, the HTTPS block needs the certificate paths and the proxy settings. This is a complete example for app1.example.com:
server {
listen 443 ssl;
server_name app1.example.com;
ssl_certificate /etc/letsencrypt/live/app1.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/app1.example.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
location / {
proxy_pass http://127.0.0.1:3001;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}The options-ssl-nginx.conf and ssl-dhparams.pem names are commonly generated by Certbot, but filenames and contents can vary by package and version. Confirm that the files exist on the target system before reloading. Do not copy a path from another server blindly.
Why the forwarded headers matter
Nginx changes some proxied headers by default, including Host and Connection, and omits headers whose values are empty. The explicit settings preserve the original host, expose the client address, append the proxy chain, and tell the application that the browser used HTTPS. Applications use these values to build absolute URLs, enforce secure cookies, record audit information and generate correct redirects.
Use the same pattern for every subdomain
| Subdomain | server_name |
proxy_pass |
Certificate directory |
|---|---|---|---|
| Application 1 | app1.example.com |
http://127.0.0.1:3001 |
/etc/letsencrypt/live/app1.example.com/ |
| API | api.example.com |
http://127.0.0.1:4000 |
/etc/letsencrypt/live/api.example.com/ |
| Dashboard | dashboard.example.com |
http://127.0.0.1:5000 |
/etc/letsencrypt/live/dashboard.example.com/ |
Keep the port 80 block for each name even after Certbot adds the redirect. The ACME challenge location must remain reachable during future renewals.
WebSocket applications need upgrade headers
Ordinary HTTP proxying is not enough for applications that upgrade a connection to WebSocket. Put this map in the global http context, not inside a server block:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}Then add the upgrade settings to the affected HTTPS location:
location / {
proxy_pass http://127.0.0.1:5000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}Use these settings for a service that actually negotiates WebSockets. Applying a forced Connection: upgrade header to every backend request can cause confusing behavior for ordinary HTTP endpoints.
Validate safely before and after reloading
- Check syntax and referenced files:
sudo nginx -t. Do not reload if this reports an error. - Reload only after a successful test:
sudo systemctl reload nginx. - Request each hostname while showing headers:
curl -I http://app1.example.comshould return a redirect, andcurl -I https://app1.example.comshould reach the proxied application. - Follow the redirect and inspect the final response:
curl -IL https://app1.example.com. - Watch Nginx’s error log while making a request if the result is a 502 or 504. The message usually identifies a refused connection, timeout, DNS failure or permission problem.
- Verify that the certificate presented for each hostname contains that exact name and has not expired. A browser’s certificate viewer or your operating system’s TLS inspection tools can show the names and dates.
A successful nginx -t checks configuration syntax and file references; it does not prove that the backend is running or that DNS and firewall rules are correct. Test all three layers independently.
Renewal and ongoing maintenance
List certificates and their expiry information with:
sudo certbot certificatesRun a safe renewal simulation before relying on unattended renewal:
sudo certbot renew --dry-runDepending on how Certbot was packaged, renewal may be triggered by a systemd timer or a cron job. Check which mechanism exists on your server and confirm it is enabled. A successful renewal must be followed by an Nginx reload so workers use the renewed certificate; many Certbot installations arrange this with a deploy hook, but verify rather than assume.
Keep port 80 available for the challenge even if every user-facing request is redirected. Removing the challenge location or blocking port 80 later is a common reason for renewal failures. Review Nginx and Certbot logs after a dry run and after the first real renewal.
Troubleshooting by symptom
Certbot cannot validate the domain
- Confirm the hostname resolves to this server from an external network.
- Check that TCP port 80 is open in the host firewall, cloud firewall and any upstream load balancer.
- Make sure the port 80 server block has the exact
server_nameand that/.well-known/acme-challenge/is not redirected into the backend. - Check that the challenge root exists and is readable by Nginx.
- Remove conflicting default-server blocks that capture the hostname before the intended block.
The browser reports a certificate-name error
The certificate may cover app1.example.com while the browser is visiting www.app1.example.com, an IP address or another alias. Request a certificate containing every exact name you publish, or redirect aliases only after they have a valid certificate.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Nginx returns 502 Bad Gateway
- Run
curlagainst the backend’s local address and port. - Check that the backend is listening on the address used by
proxy_pass; a service bound to a Unix socket or a different interface needs a matching directive. - Confirm the upstream protocol. Sending HTTP to an HTTPS-only backend, or HTTPS to an HTTP-only backend, fails before the application sees the request.
- Inspect the Nginx error log for connection refusal, name-resolution and timeout details.
Requests reach the wrong application
Check for duplicate or wildcard server_name values and for a default server that catches unmatched names. Ensure each HTTPS block has the intended hostname and that DNS does not point one subdomain at another proxy.
Redirect loops or incorrect HTTP links
Keep proxy_set_header X-Forwarded-Proto $scheme in the proxy block and configure the application to trust the proxy’s forwarded headers according to its own documentation. A backend that believes every request is HTTP may redirect an already secure request repeatedly.
WebSocket connections close immediately
Confirm proxy_http_version 1.1, the Upgrade header, the mapped Connection header and any application-specific WebSocket path. Check idle timeout settings if connections survive the handshake but drop later.
Quick Recap
Operational and security choices
- Separate certificates or one multi-name certificate: A certificate per subdomain makes ownership and replacement independent. A certificate containing several names reduces the number of files but couples their renewal and exposure; choose deliberately rather than mixing approaches accidentally.
- HTTP upstream or HTTPS upstream: Local HTTP is common when the host is trusted and isolated. Use HTTPS to protect traffic across an untrusted network segment, and configure upstream certificate verification rather than treating encryption alone as authentication.
- Local binding: Bind applications to loopback when Nginx is on the same host. This prevents clients from bypassing TLS and proxy policy by connecting directly to an application port.
- Logs and limits: Keep per-host access and error logs where practical. Add upload limits, timeouts and rate controls based on the application instead of copying arbitrary values between services.
- Configuration changes: Make a backup before automated edits, run
nginx -tafter every change, and reload rather than restart where possible so existing connections are not needlessly dropped.
A repeatable deployment checklist
- Create DNS records and verify external resolution for every subdomain.
- Open ports 80 and 443 and keep backend ports private.
- Verify each application locally and record its protocol and port.
- Create one port 80 server block per hostname with the ACME challenge location.
- Run
nginx -tand reload Nginx. - Run
sudo certbot --nginx -d exact-subdomain.example.comfor each exact name. - Review the generated HTTPS block, certificate paths and redirect behavior.
- Add the appropriate proxy headers; add WebSocket upgrade settings only where required.
- Run
nginx -t, reload, and test both HTTP redirection and HTTPS proxying. - Run
sudo certbot renew --dry-runand verify the installed renewal timer or cron job.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
