Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteConfigure HTTPS on an Ubuntu Apache server in this order: point every hostname at the server in DNS, create a separate name-based VirtualHost for each site, enable and validate those hosts, then use Certbot’s Apache plugin to obtain one certificate covering the required names. Test both HTTPS routing and HTTP behavior, and verify automatic renewal with a dry run. A subdomain can serve a completely different site when its ServerName and DocumentRoot are defined in their own VirtualHost.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you need before changing Apache
Have a registered domain, administrative access to the Ubuntu server, and control of the domain’s DNS zone. Let’s Encrypt is a free, automated certificate authority trusted by major browsers and clients, but it can issue a certificate only after it proves control of each requested hostname. For ordinary HTTP-01 validation, the hostname must resolve publicly to this server and Apache must be reachable on TCP port 80.
As an Amazon Associate I earn from qualifying purchases.
- Create an
Arecord for the IPv4 address of the server and, when IPv6 is configured correctly, anAAAArecord for the IPv6 address. - Create records for the apex name and every subdomain you will request, such as
example.com,www.example.com, andapp.example.com. - Allow inbound TCP 80 and 443 in both Ubuntu’s firewall and any cloud or datacenter security group in front of the machine.
- Make sure the DNS records have propagated before asking the certificate authority to validate them.
An incorrect or stale AAAA record is a common cause of apparently mysterious failures: a validator may reach an IPv6 address where Apache is not configured, even though the A record is correct. Check every hostname from an external resolver and confirm that all returned addresses belong to this server. If you publish both record types, both paths should reach the same intended Apache service.
Make a list of the exact names users will visit before you begin. A certificate for example.com does not automatically cover www.example.com or app.example.com, and a DNS record by itself does not configure Apache. Keeping the DNS, VirtualHost, and certificate name lists identical prevents most setup errors.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Plan the hostnames and certificate scope
Decide which names should serve the main site and which should serve separate applications. Apache uses name-based virtual hosting: it selects a VirtualHost by the hostname supplied by the browser, then serves that host’s configured document root.
| Use case | Apache setting | Certificate requirement |
|---|---|---|
| Main domain only | ServerName example.com |
Certificate includes example.com |
| Main domain and an alias | ServerName example.com plus ServerAlias www.example.com |
Both names must be requested or otherwise covered by the certificate |
| Independent subdomain site | Separate host with ServerName app.example.com and its own DocumentRoot |
Certificate includes app.example.com |
| Many subdomains | Optional Apache alias such as ServerAlias *.example.com |
A wildcard certificate requires DNS-01 validation; the alias alone does not create DNS records or certificate coverage |
Putting several names on one certificate is normal. Certbot treats each -d argument as a name to include, and the additional names become Subject Alternative Names. Separate certificates can still be useful when sites have different ownership or renewal boundaries, but the Apache routing decision is made by VirtualHost configuration, not by the certificate.
Use an explicit ServerName for every independent site. Use ServerAlias only when the alias should serve exactly the same application and files. A wildcard alias may catch unexpected hostnames, so it is generally less predictable than separate, named hosts. Remember that Apache’s wildcard matching does not provision DNS, issue certificates, or create applications for those names.
Create a document root and VirtualHost for each site
Prepare the directories
Create a directory that contains the public files for each site. Keeping separate roots prevents a request for one hostname from accidentally exposing another application’s files.
sudo mkdir -p /var/www/example.com/public
sudo mkdir -p /var/www/app.example.com/publicPlace each site’s intended index file in its own public directory and set ownership and permissions according to the application’s deployment method. The critical Apache requirement is that the process can read the document root and traverse its parent directories. If the files are readable but a parent directory blocks traversal, Apache can still return a 403 error.
Keep logs separate as well. Distinct error and access logs make it possible to tell whether a request reached the intended host when several sites share one server.
Recommended Free Tools
Create the main-domain host
Save a file such as /etc/apache2/sites-available/example.com.conf:
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/example.com/public
<Directory /var/www/example.com/public>
AllowOverride All
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/example-error.log
CustomLog ${APACHE_LOG_DIR}/example-access.log combined
</VirtualHost>ServerName is the canonical hostname. Add a ServerAlias only for names that should serve the same files. The directory block grants access to that root and permits per-directory rules through .htaccess with AllowOverride All; if the application does not use .htaccess, a more restrictive override policy may be preferable.
The port-80 host is needed even when the finished site will redirect visitors to HTTPS. It gives Apache a place to answer HTTP-01 challenges and provides a clear routing target while you test DNS and certificate issuance.
Create a separate subdomain host
Save /etc/apache2/sites-available/app.example.com.conf with a different root and separate logs:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
<VirtualHost *:80>
ServerName app.example.com
DocumentRoot /var/www/app.example.com/public
<Directory /var/www/app.example.com/public>
AllowOverride All
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/app-error.log
CustomLog ${APACHE_LOG_DIR}/app-access.log combined
</VirtualHost>This is how you point a subdomain to a different Apache site: give it its own DNS record, ServerName, document root, and VirtualHost file. Do not rely on a wildcard ServerAlias to perform application routing; an explicit host is easier to audit and prevents an unintended hostname from landing on the wrong site.
The subdomain does not need to share the main site’s directory, aliases, or logs. It can use different rewrite rules and deployment permissions, provided its directory block grants Apache the access the application requires.
Enable hosts and check Apache’s selection
- Enable each configuration file:
sudo a2ensite example.com.confandsudo a2ensite app.example.com.conf. - Check syntax before reloading:
sudo apachectl configtest. Continue only when it reportsSyntax OK. - Inspect the loaded map of addresses and name-based hosts with Apache’s virtual-host diagnostic command:
sudo apachectl -S. Confirm that each hostname is attached to the expected file and that an unintended default host is not first. - Reload Apache after a successful check:
sudo systemctl reload apache2.
At this stage, test the sites over plain HTTP. Requesting http://example.com and http://app.example.com should return content from their respective roots. Fix routing before attempting certificate issuance; Certbot’s Apache plugin searches the enabled VirtualHost blocks and needs a matching host.
Apache ships with a default virtual host that can serve as a template. On a multi-site server, however, do not assume that the default host is harmless: if no ServerName matches, Apache may answer with the first host for that address and port. The output of apachectl -S shows which file is first and helps explain an unexpected page.
Install Certbot and request the certificate
Install Certbot and its Apache integration using the current Ubuntu package guidance. The Apache plugin can locate matching VirtualHost blocks in /etc/apache2/sites-enabled/, add the required TLS directives, and reload Apache after installation.
Request all names that should be covered together:
sudo certbot --apache -d example.com -d www.example.com -d app.example.comCertbot will ask for an email address and agreement to the certificate authority’s terms, then offer redirect behavior when the Apache configuration permits it. Supplying multiple -d options places the names on one certificate as Subject Alternative Names. Include only hostnames whose DNS already points to this server and whose HTTP service is reachable.
The command can include just the apex and one subdomain, or every public name that should share the lineage. If you later add a hostname, request a certificate that includes the complete desired set rather than assuming the old certificate changes automatically.
If you do not want Certbot to edit Apache automatically, obtain the certificate with webroot mode instead:
sudo certbot certonly --webroot -w /var/www/example.com/public -d example.com -d www.example.comIn webroot mode, Certbot writes a temporary challenge file below the specified root. Apache must serve that path without application rewrites or authentication blocking it. You then reference the resulting certificate files in your own TLS VirtualHost configuration. This approach gives you manual control, but you must also ensure that your configuration reloads Apache after a successful renewal.
Understand HTTP-01 and DNS-01 validation
| Validation method | What must work | When to choose it |
|---|---|---|
| HTTP-01 | Public DNS resolves to the server and inbound TCP 80 reaches Apache, including the ACME challenge path | Standard public websites where port 80 can remain reachable |
| DNS-01 | A required _acme-challenge TXT record is created in DNS |
Port 80 cannot be reached, the service is not directly exposed, or a wildcard certificate such as *.example.com is required |
HTTP-01 is usually the simplest choice for a normal public site. A port-80 redirect to HTTPS does not remove the need for port 80: the challenge request must still reach the ACME handler. If HTTP-01 cannot work, use an appropriate DNS-01 plugin and create the TXT record requested by Certbot. DNS-01 proves control of the DNS zone and is the validation method required for wildcard names.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
An Apache declaration such as ServerAlias *.example.com only changes how Apache matches requests that arrive. It does not create DNS records for arbitrary subdomains and does not make those names appear on a certificate. A wildcard certificate covers names in the wildcard’s scope, but it still does not make a nonexistent DNS name resolve.
When using DNS-01, update the authoritative DNS zone, not merely a local resolver or secondary interface. Wait for the TXT record to be visible publicly before retrying validation. For HTTP-01, verify the challenge URL through the same public path a certificate authority will use, including any load balancer, NAT rule, or edge firewall.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Configure the HTTPS VirtualHosts and redirects
When you run certbot --apache, the plugin can add the TLS directives to matching hosts. Verify that each HTTPS hostname serves the intended document root and that the certificate lists the exact name in the browser’s certificate details.
If you want every HTTP request redirected to HTTPS, select Certbot’s redirect option when offered, or add an explicit port-80 redirect VirtualHost after the HTTPS site has been tested. Keep the ACME challenge path reachable during future renewals; an unconditional rewrite that blocks the challenge can make an otherwise valid renewal fail.
For a manually managed TLS host, the essential shape is:
<VirtualHost *:443>
ServerName app.example.com
DocumentRoot /var/www/app.example.com/public
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/app.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/app.example.com/privkey.pem
<Directory /var/www/app.example.com/public>
AllowOverride All
Require all granted
</Directory>
</VirtualHost>The exact TLS module and site-enabling steps depend on the Ubuntu Apache package configuration; always run sudo apachectl configtest before reloading. Do not copy a certificate path from one certificate lineage to another: use the directory shown by Certbot for the certificate that covers the hostname.
Free tools Windows power users keep installed
One-click scans. No signup required.
Test the HTTPS host directly before forcing redirects. Check the main domain and each subdomain separately, because a valid certificate on one name does not prove that Apache selects the right TLS VirtualHost for another name. Once each HTTPS response is correct, verify that an HTTP request receives the intended redirect and that the challenge URL remains an exception when HTTP-01 is in use.
Know where certificates are stored
Certbot maintains certificate lineages below /etc/letsencrypt/live/<domain>/. The important files are:
fullchain.pem: the server certificate followed by the required intermediate certificates.privkey.pem: the private key; protect it from non-administrative users and do not publish it.
Apache should reference the files in the live directory rather than copying certificate material into a web root. Certbot updates the lineage during renewal, so a successful renewal followed by an Apache reload makes the new certificate available without changing your VirtualHost file.
Keep the private key readable only by the services and administrators that need it. If a manually maintained configuration points at a copied certificate elsewhere, renewal may update the live path while Apache continues serving the old copy.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Verify automatic renewal
Let’s Encrypt certificates have a 90-day lifetime according to current Ubuntu Server guidance. Ubuntu documents a Certbot systemd timer that attempts renewal twice a day. The timer is not a substitute for testing: run a renewal simulation yourself.
sudo certbot renew --dry-runA successful dry run confirms that the renewal method, DNS or HTTP challenge, and local Certbot configuration can complete without replacing the live certificate. Apache installations managed by Certbot are reloaded after a successful renewal. If you manage TLS directives yourself, verify that your deployment also reloads Apache after renewal.
Run the dry run after initial setup, after changing DNS, after changing redirects or firewall rules, and before relying on unattended renewal for production. Keep port 80 and the challenge path available for every hostname using HTTP-01. A timer that runs twice daily cannot fix a permanently broken DNS record, blocked port, or disabled VirtualHost.
Point a subdomain at a different Apache site
- Create
app.example.comin DNS, pointing it to the server’s public address. - Create
/var/www/app.example.com/publicand place the application files there. - Create a dedicated VirtualHost whose
ServerNameis exactlyapp.example.comand whoseDocumentRootis that directory. - Enable the file with
a2ensite, runapachectl configtest, inspectapachectl -S, and reload Apache. - Confirm the HTTP request reaches the new root, then request or reissue a certificate containing
-d app.example.com. - Test
https://app.example.combefore enabling an HTTP-to-HTTPS redirect for that host.
If the subdomain displays the main site, Apache is usually matching an earlier or default VirtualHost, the intended file is not enabled, or the request’s hostname does not match the configured ServerName/ServerAlias. The virtual-host map and separate access logs identify which configuration is receiving the request.
If the browser reports a certificate-name warning while the HTTP page is correct, routing and certificate scope are out of sync. Add the exact hostname to the certificate request, then confirm that the HTTPS VirtualHost uses the renewed lineage and that Apache was reloaded.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot issuance, routing, and renewal
DNS does not resolve to this server
Check A and AAAA answers for every requested name from outside the server’s network. Correct stale records, missing records, or an IPv6 address that does not accept the connection. Wait for the DNS change to propagate, then retry validation. Do not test only the apex name when the certificate request also contains www or an application subdomain.
Port 80 or 443 is blocked
Check both layers of filtering: the Ubuntu host firewall and the provider’s cloud security group or edge firewall. HTTP-01 specifically needs inbound port 80; HTTPS service needs port 443. If port 80 cannot be exposed, use DNS-01 rather than repeatedly retrying HTTP-01.
Apache reports a configuration error
Run sudo apachectl configtest and fix the first reported error before reloading. Common causes include a misspelled directive, an unmatched configuration tag, a nonexistent document root, or a certificate path that does not exist. Use sudo apachectl -S to find duplicate or unexpected host definitions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The wrong site answers
Confirm the browser is requesting the intended fully qualified hostname, the VirtualHost file is present in /etc/apache2/sites-enabled/, and its ServerName is exact. Review the host-specific access log and disable an obsolete default site only after confirming that no required host depends on it.
Renewal fails after a redirect or application change
Run sudo certbot renew --dry-run and inspect whether the challenge URL can still be served. For HTTP-01, temporarily remove rules that block the ACME challenge path or ensure the redirect allows the challenge handler to answer. For DNS-01, verify that the plugin can create the required _acme-challenge TXT record and that the authoritative DNS zone is the one being updated.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
The certificate is valid but the browser still warns
Check the hostname in the address bar character for character, including www and each subdomain. Inspect the served certificate and compare its names with the request. Then check which TLS VirtualHost answered with apachectl -S; a correct certificate installed on the wrong host can look like a certificate problem when it is actually a routing problem.
Final production checklist
- Every certificate name has a working A or AAAA record pointing to the server.
- TCP 80 and 443 are allowed wherever the chosen validation and service require them.
- Each site has the correct
ServerName, optional aliases, and document root. - All intended site files are enabled under
/etc/apache2/sites-enabled/. sudo apachectl configtestreturnsSyntax OK.sudo apachectl -Sshows the expected name-based hosts.- The requested certificate includes every hostname users will visit.
- HTTPS serves the intended site for the main domain and each subdomain.
- HTTP behavior is deliberate: either the site remains available for validation or redirects while preserving the ACME challenge path.
sudo certbot renew --dry-runcompletes successfully.
Frequently Asked Questions
How do I configure HTTPS for Apache on Ubuntu?
Point the domain’s DNS records to the Ubuntu server, allow TCP 80 and 443, create and enable a matching Apache VirtualHost, run sudo apachectl configtest, and request the certificate with sudo certbot --apache -d example.com. Test the HTTPS host and then verify renewal with sudo certbot renew --dry-run.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do I add HTTPS to an Apache subdomain?
Create a DNS record for the subdomain, define a VirtualHost with that exact ServerName and its own document root, enable it, and include the subdomain in Certbot’s request, for example -d app.example.com. Confirm that the HTTPS VirtualHost serves the subdomain’s files.
How do I point a subdomain to a different Apache site?
Give the subdomain its own DNS record, directory, VirtualHost file, ServerName, DocumentRoot, and logs. Enable the file, run apachectl -S to confirm Apache’s host map, reload Apache, and test the subdomain before issuing its certificate.
Do I need a separate certificate for every subdomain?
No. Certbot can place the apex domain and multiple subdomains on one certificate by supplying multiple -d options. Every hostname users visit must still be included, or covered by an appropriate wildcard certificate.
Can a wildcard ServerAlias provide HTTPS for all subdomains?
No. ServerAlias *.example.com only changes Apache request matching. It does not create DNS records or certificate coverage. A wildcard certificate such as *.example.com requires DNS-01 validation.
Recommended Free Tools
What if port 80 is unavailable?
HTTP-01 validation normally requires inbound port 80. If that port cannot reach Apache, use DNS-01 validation and create the required _acme-challenge TXT record. DNS-01 is also required for wildcard certificates.
Where does Certbot store the Apache certificate and key?
Certbot maintains certificate lineages under /etc/letsencrypt/live/<domain>/. Apache normally uses fullchain.pem for the certificate chain and privkey.pem for the private key. Keep the key protected and out of web roots.
How often should I test Let’s Encrypt renewal?
Ubuntu documents a systemd timer that attempts renewal twice daily, while Let’s Encrypt certificates last 90 days. Run sudo certbot renew --dry-run after setup and after changes to DNS, redirects, firewalls, or VirtualHosts.
The Bottom Line
Reliable Apache HTTPS setup is a coordination task: DNS must point every name to the server, each name needs an unambiguous VirtualHost, and the certificate must list every hostname users request. Use HTTP-01 when port 80 is reachable, DNS-01 for blocked servers or wildcards, preserve the ACME challenge path, and prove unattended renewal with sudo certbot renew --dry-run.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
