The reliable order is: point every shop hostname at the VPS, open ports 80 and 443, obtain a Let’s Encrypt certificate with Certbot, configure Apache or Nginx to serve the full chain on 443, then enable secure URLs in PrestaShop and test every customer journey. Automate renewal and reload the web server after renewals. Do not enable HSTS until every required page, asset, callback and API works over HTTPS.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you need before changing anything
HTTPS is a chain of separate systems. A certificate alone does not make a PrestaShop shop secure: DNS must reach the correct VPS, the certificate authority must be able to validate the domain, the web server must present the certificate and private key, and PrestaShop must generate secure links and enforce secure controllers.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- The exact PrestaShop version and whether the shop is single-store or multistore.
- Your Linux distribution and its supported Certbot installation method.
- The web server (Nginx or Apache), PHP-FPM or mod_php arrangement, document root and canonical hostname.
- Whether
wwwis used, which subdomains are customer-facing, and whether a reverse proxy or CDN sits in front of the VPS. - Access to the VPS, its provider firewall and its local firewall.
Back up the web-server configuration, PrestaShop files and database first. Certbot’s web-server installer can edit configuration; retaining a known-good copy gives you a rollback path if validation or reload fails.
Choose validation and certificate scope
HTTP-01 or DNS-01
| Method | What must be reachable | When it fits |
|---|---|---|
| HTTP-01 | Let’s Encrypt must reach the VPS on Internet-facing TCP port 80 and retrieve a challenge response. | Use when port 80 can be exposed and the web server can serve /.well-known/acme-challenge. |
| DNS-01 | A DNS challenge record must be created for the domain; inbound port 80 is not required. | Use when port 80 cannot be exposed or when certificate issuance is managed through DNS. |
Before requesting a certificate, create A and, where applicable, AAAA records for every name that will appear in it. For a shop using both names, that normally means example.com and www.example.com; include any required shop subdomains as well. Confirm that each name resolves to this VPS rather than to an old host, parking service or proxy that cannot pass the challenge.
#1 Best Overall
One certificate or several
Request all customer-used names in one certificate when they share the same web-server configuration. A single certificate simplifies renewal, but every listed name must resolve correctly. Separate certificates can be appropriate when domains terminate in different virtual hosts or infrastructure. Never substitute an IP address for a domain when requesting a normal publicly trusted certificate.
Prepare DNS, firewalls and the HTTP listener
- Create the required A/AAAA records and wait until public DNS resolvers return the VPS address. Check each hostname independently.
- Permit inbound TCP 80 and 443 in both the VPS firewall and the hosting provider’s firewall. HTTP-01 cannot work if either layer blocks port 80.
- Make sure the selected virtual host answers for every requested name. A default site that answers the wrong hostname can cause validation to reach the wrong document root.
- If a reverse proxy or CDN is present, verify that it forwards the original host and protocol and that its origin settings will be changed to HTTPS after the certificate is installed.
Keep an HTTP listener during issuance and renewal. You can redirect normal requests to HTTPS, but the challenge path must remain reachable whenever the HTTP-01 method is used.
Free tools Windows power users keep installed
One-click scans. No signup required.
Install Certbot using the method for your operating system
Use Certbot’s current official instructions for the actual Linux distribution and web server. Package names and supported installation methods differ between distributions; an Ubuntu command is not automatically correct on another system.
The documented snap-based approach installs Certbot, links /snap/bin/certbot into /usr/local/bin, and then uses the Apache or Nginx installer. If your distribution provides another supported method, follow that method instead and keep Certbot updated.
Choose between an integrated installer and manual configuration:
Rank #2
| Approach | Command or action | What changes |
|---|---|---|
| Apache installer | sudo certbot --apache |
Certbot obtains the certificate and can install it in a supported Apache virtual host. |
| Nginx installer | sudo certbot --nginx |
Certbot obtains the certificate and can install it in a supported Nginx server block. |
| Manual server configuration | sudo certbot certonly with an appropriate authenticator |
Certbot obtains files, while you edit and maintain the TLS configuration yourself. |
Use the integrated installer only when its proposed edits match your deployment. If you use certonly, the resulting files are placed under /etc/letsencrypt/live/<certificate-name>/; your web server must reference the full chain and private key there.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchObtain the certificate
Using the web-server installer
Run the installer for the server that actually handles requests. During the prompts, select every hostname customers use and choose whether HTTP requests should redirect to HTTPS. For example, the requested names can include -d example.com -d www.example.com. Confirm the virtual host or server block has those names before accepting changes.
After issuance, inspect the resulting configuration rather than assuming the installer selected the intended site. The certificate must include all requested names, and the server must use the certificate belonging to this shop.
Using certonly and webroot
The webroot authenticator writes a temporary token below /.well-known/acme-challenge. The selected HTTP site must serve that directory without routing it into a login page, maintenance response or different application. A redirect to HTTPS is acceptable only if the validation request ultimately reaches the correct challenge content; test the path before retrying issuance.
Manual mode is useful when configuration is generated by deployment tooling, when several services share a machine, or when you need complete control over redirects. It also means you must install the certificate, preserve the private-key permissions and arrange reloads yourself.
Configure Nginx for PrestaShop
Adapt PrestaShop’s official Nginx template to your distribution, PHP integration and document root; it is an example, not a universal drop-in file.
HTTPS server block
- Use
listen 443 ssl http2(or the syntax supported by your installed Nginx version). - Set
server_nameto the exact canonical name and any aliases served by this block. - Point
ssl_certificateto the Let’s Encrypt full chain, such as/etc/letsencrypt/live/<certificate-name>/fullchain.pem. - Point
ssl_certificate_keyto the matching private key, such as/etc/letsencrypt/live/<certificate-name>/privkey.pem. - Set the actual PrestaShop document root and retain the location and PHP-FPM rules required by your installation.
The full-chain file matters: serving only the leaf certificate can produce trust errors for some clients even when the certificate itself is valid. Protect the private key so only the required service account and administrators can read it.
HTTP block and redirect
Keep an HTTP server block on port 80. It should return a permanent redirect to the chosen canonical HTTPS URL for ordinary requests, while allowing /.well-known/acme-challenge to be served during HTTP-01 issuance and renewal. Decide whether the canonical destination is the apex name or www, and avoid a redirect chain such as HTTP to one hostname, then HTTPS to another.
Check the configuration before reloading:
sudo nginx -t
sudo systemctl reload nginxIf the syntax test fails, do not reload. Correct the server block, certificate path, include file or duplicate server_name first. After reloading, inspect the certificate actually served on port 443 rather than relying only on files on disk.
Configure Apache for PrestaShop
Create or adapt a TLS virtual host for the shop. Enable the SSL and rewrite modules required by your distribution, and keep AllowOverride All where PrestaShop’s .htaccess rules are needed. The Apache example supplied by PrestaShop must be adjusted for your PHP handler, filesystem paths and virtual-host layout.
Rank #4
- Set the virtual host’s names to the certificate names and choose one canonical hostname.
- Reference the Let’s Encrypt full-chain certificate and matching private key.
- Ensure the document root is the real PrestaShop directory and that the service can read the public files.
- Retain the HTTP virtual host so it can serve ACME challenges and redirect normal traffic to HTTPS.
Validate and reload with the commands appropriate to your distribution:
sudo apachectl configtest
sudo systemctl reload apache2Some distributions use a different service name. The important check is a successful configuration test followed by a reload of the Apache instance that owns the virtual host.
Recommended Free Tools
Enable HTTPS inside PrestaShop
Only change the Back Office setting after the web server successfully serves the shop over HTTPS. If SSL was not enabled during installation, enable the shop’s SSL or secure-URL setting in the Back Office for the relevant shop context, then clear the PrestaShop cache and verify regenerated URLs.
The command-line installer exposes an ssl option from PrestaShop 1.7.4 onward. That option affects installation; an existing shop still needs its current Back Office configuration checked.
Multistore and application endpoints
In a multistore deployment, inspect every shop and domain context separately. Update each canonical URL and every external endpoint that must return to the shop:
- Payment-module return and callback URLs.
- Webhooks and API endpoints.
- Back Office and employee login URLs.
- CDN or reverse-proxy origin and protocol settings.
PrestaShop front controllers can be marked as requiring SSL so non-secure requests are redirected. Use that mechanism where appropriate, but do not treat it as a substitute for the server-level redirect and correct proxy headers.
Remove mixed-content sources
Search themes, modules and configuration for hard-coded http:// asset or API URLs. Replace them with secure URLs or protocol-aware configuration, then clear caches so old HTML is not served. A proxy that fails to pass the original protocol can also make PrestaShop generate HTTP links even though the browser connected with HTTPS.
Test the complete shop, not just the home page
Visit the canonical HTTPS URL in a browser and check the lock indicator, then test each hostname and workflow that customers or administrators use.
- The apex hostname and the
wwwvariant, if both are published. - The Back Office login and an authenticated session.
- Product pages, images, CSS and JavaScript.
- Cart, checkout and payment return flows.
- Module AJAX calls, webhooks and API requests.
- Any language, currency, multistore or subdomain URL.
Use browser developer tools to identify mixed-content failures. Confirm that an HTTP request redirects once to the chosen HTTPS hostname, that no login credentials or session cookies are sent over HTTP, and that the certificate presented on 443 contains the expected names and a complete chain.
Common symptoms point to different layers:
| Symptom | Likely check |
|---|---|
| Certificate issuance times out | DNS target, provider firewall, VPS firewall and port 80 reachability for HTTP-01. |
| Wrong certificate appears | Server-name matching, duplicate virtual hosts and the certificate actually presented on 443. |
| Browser reports an incomplete chain | Use the Let’s Encrypt full-chain file, not only the leaf certificate. |
| Mixed-content warnings remain | Theme/module URLs, cached HTML, payment callbacks and proxy protocol forwarding. |
| Back Office works but checkout fails | Payment return URLs, AJAX endpoints, cookies and multistore domain context. |
| Renewal changes files but users still see the old certificate | Reload Apache or Nginx after renewal and verify externally. |
Automate renewal and prove it works
Let’s Encrypt certificates are short-lived, so unattended renewal is part of the setup rather than an optional maintenance task. Use the Certbot timer or cron installed by your chosen method and keep Certbot updated.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Identify the timer or cron entry that runs recurring
certbot renew. - Run a staging dry run where supported, so renewal logic is tested without consuming production issuance capacity.
- Configure a deploy hook or equivalent action that reloads Apache or Nginx after a successful renewal.
- Verify that the newly served certificate, not merely the file timestamp, contains the current expiry and expected names.
- Record an alert or monitoring check for renewal failures and for an approaching certificate expiry.
A renewal is incomplete if Certbot replaces files under /etc/letsencrypt/live but the web server continues serving an old certificate. Test the externally visible result after every change and after the first unattended renewal.
When to enable HSTS
HTTP Strict Transport Security tells browsers to use HTTPS automatically, which can make recovery harder if any required hostname or path still depends on HTTP. PrestaShop’s Nginx example includes an HSTS line with a warning not to use it until the site is fully on HTTPS.
Wait until every shop domain, asset, callback, API, administrative path and proxy route has passed the HTTPS tests. Only then add HSTS deliberately, starting with a policy appropriate to your deployment and validating that all subdomains can also remain HTTPS if you include them.
Quick Recap
A repeatable deployment checklist
- Backups of the database, files and web-server configuration exist.
- Every certificate hostname resolves to the intended VPS or correctly configured validation service.
- TCP 80 and 443 are allowed through provider and VPS firewalls.
- The chosen Certbot method matches the operating system and web server.
- The certificate includes every required name and the server presents the full chain on 443.
- The HTTP listener preserves ACME challenge access and redirects normal traffic once to canonical HTTPS.
- PrestaShop secure URLs, multistore domains and SSL-required controllers are configured.
- The Back Office, checkout, payment returns, AJAX, images, scripts and APIs work without mixed content.
- Renewal runs automatically, reloads the web server and has been tested with a dry run and an external check.
- HSTS is enabled only after the migration is complete.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
