Host each domain in its own name-based HTTPS virtual host. Every <VirtualHost *:443> block needs an exact ServerName, only the appropriate ServerAlias values, that site’s DocumentRoot, its certificate and key, and a matching <Directory> authorization rule. Point every domain’s DNS records at the server, then validate Apache’s vhost map. If Apache serves the wrong site, the usual causes are a hostname that does not match, a missing DNS record, an incorrect listener, or vhost ordering that makes another block the fallback.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
How Apache chooses the site for an HTTPS request
Apache does not choose a document root from the directory name on disk. It first groups virtual hosts by the local IP address and port that accepted the connection. For HTTPS, that is normally port 443. Within that group, Apache uses the hostname supplied during TLS negotiation and then the HTTP Host header to select the best ServerName or ServerAlias match. The selected block supplies the document root, certificate, logs, and other settings.
As an Amazon Associate I earn from qualifying purchases.
If no hostname matches, Apache serves the first virtual host in that IP-and-port group. That ordering rule is why a typo, an unconfigured alias, or an unknown hostname can display another domain’s files. Treat the first block as an intentional default rather than an accidental leak.
Why SNI is required for separate certificates
TLS negotiation happens before Apache receives the normal HTTP Host header. Server Name Indication (SNI) places the requested hostname in the TLS handshake, allowing Apache to select the correct SSL virtual host and certificate before HTTP begins. With SNI, many domains can share one IP address and port while retaining different certificates and complete configurations.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
SNI depends on TLS-extension support in the client, Apache, and its TLS library. Very old non-SNI clients cannot reliably select among different certificates on one address. If those clients matter, use a certificate that covers all required names, provide separate IP addresses, or expose separate ports instead. A wildcard certificate or a Subject Alternative Name (SAN) certificate can cover multiple names, but it does not remove the need for separate virtual-host blocks when the sites have different roots, logs, or application settings.
Prerequisites before editing Apache
- Administrative access to the Apache server and permission to edit its configuration.
- A DNS A record and, where applicable, an AAAA record for every hostname. Each record must resolve to an address that reaches this Apache instance; creating a virtual host does not create DNS.
- A directory tree for each site, with a deliberate public web root such as
/var/www/example.com/public. - A certificate whose names cover the domain and aliases, plus the corresponding private key and, when supplied, the full certificate chain.
- Apache built with SSL support and configured to listen on TCP port 443. Distribution names for modules, service units, site-enabling commands, and certificate locations differ.
- A plan for HTTP traffic. Most installations use port 80 only to redirect each hostname to its HTTPS equivalent.
Do not copy certificate paths or service commands blindly. The paths in the example below are illustrative; use the locations created by your certificate issuer and the conventions of your operating system.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use a separate filesystem root for each domain
Keep each site’s publicly served files in its own directory. This makes an incorrect match obvious, limits accidental cross-site exposure, and lets you assign independent logs and deployment permissions. For example:
/var/www/example.com/public
/var/www/example.org/publicPlace a small, unmistakable test file in each root while configuring, such as example.com/public/index.html containing the domain name. Remove or replace those files after verification. The parent directories must be searchable by Apache, and the web roots must contain the content or front controller your application expects.
Build the HTTP-to-HTTPS redirect layer
Create an HTTP virtual host for each public hostname. The redirect should name the canonical HTTPS host explicitly so that an alias such as www.example.com does not redirect to an unintended domain.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
Redirect permanent / https://example.com/
</VirtualHost>Repeat the block for example.org and its aliases, changing both the names and the redirect target. If an application must preserve a path and query string, verify the redirect behavior in your Apache version and application rather than assuming a blanket rule is safe. The redirect vhost does not serve the site’s files; the HTTPS vhost does.
Create one HTTPS virtual host per domain
Every independently hosted domain gets its own <VirtualHost *:443> block. Set an explicit ServerName, list only aliases that should display the same site, point DocumentRoot at that site’s public directory, enable TLS, and authorize that directory.
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/example.com/public
SSLEngine On
SSLCertificateFile /etc/ssl/example.com/fullchain.pem
SSLCertificateKeyFile /etc/ssl/example.com/privkey.pem
ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
<Directory /var/www/example.com/public>
Require all granted
</Directory>
</VirtualHost>
<VirtualHost *:443>
ServerName example.org
ServerAlias www.example.org
DocumentRoot /var/www/example.org/public
SSLEngine On
SSLCertificateFile /etc/ssl/example.org/fullchain.pem
SSLCertificateKeyFile /etc/ssl/example.org/privkey.pem
ErrorLog ${APACHE_LOG_DIR}/example.org-error.log
CustomLog ${APACHE_LOG_DIR}/example.org-access.log combined
<Directory /var/www/example.org/public>
Require all granted
</Directory>
</VirtualHost>The two blocks intentionally repeat the structure while changing every domain-specific value. A certificate can cover several aliases, but each alias still has to appear in ServerName or ServerAlias if it should reach that site. Do not put an alias in two unrelated vhosts; Apache’s first matching definition can then produce confusing results.
What each directive controls
ServerName: the primary hostname for the site. Use the exact DNS name clients request.ServerAlias: additional names that intentionally use the same certificate, files, and application.DocumentRoot: the filesystem directory Apache maps to URL path/for this vhost.SSLEngine On: enables TLS handling in the HTTPS block.SSLCertificateFileandSSLCertificateKeyFile: identify the certificate chain file and private key for that hostname. Protect the key from web access and from users who do not administer the service.ErrorLogandCustomLog: separate diagnostic and request logs, which are essential when two sites appear similar.<Directory> ... Require all granted: authorizes requests to the exact filesystem root. The path must matchDocumentRootcharacter for character.
Enable the configuration and reload safely
How you enable a site and restart the service depends on the distribution. Some systems use a sites-available/sites-enabled layout; others load every file from a conf.d directory. Follow the local convention and ensure the SSL module is enabled.
- Save the HTTP and HTTPS blocks in the configuration location Apache actually includes.
- Enable the SSL module and any required virtual-host configuration mechanism using your distribution’s documented commands.
- Run the configuration syntax check, commonly
apachectl configtestor an equivalent command. Do not reload after a failed check. - Inspect the parsed vhost map with
apachectl -S(the command name can vary). Confirm that both domains appear under the address and port clients use, and note which block is listed first. - Reload Apache through the service manager rather than killing the process. A reload applies configuration changes while allowing existing connections to finish.
- Keep the previous working configuration available so you can restore it if the reload reports an error.
A successful syntax check proves that Apache can parse the file; it does not prove that DNS, certificates, permissions, or application routing are correct. Continue with the external tests below.
Recommended Free Tools
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Point DNS and certificates at the same server
For each hostname, verify that DNS resolves to the public address on which Apache listens. Check both A and AAAA records if IPv6 is published. An AAAA record pointing elsewhere can make some clients reach a different machine even when the A record is correct. DNS changes may be cached according to the record’s TTL, so test from a resolver that reflects the current data.
The certificate presented for a hostname must contain that exact name in its subject or SAN entries. A certificate for example.com does not automatically cover www.example.com, and a certificate for one parent domain does not cover an unrelated domain. Use the full chain file supplied for the service where required; sending only the leaf certificate can cause trust failures on some clients.
DNS and Apache solve different problems: DNS directs a name to an address, while the vhost map decides which content to serve after the connection arrives. Correcting one cannot compensate for an error in the other.
Verify each domain before declaring success
- Resolve every hostname and confirm the result is an address assigned to this server.
- Request each HTTPS URL with a browser or an HTTP client and check both the certificate identity and the returned page.
- Request the HTTP URL and confirm it reaches the intended HTTPS hostname.
- Check the per-vhost access log immediately after each request. The request should appear in the log belonging to the selected domain, not merely in a global log.
- Inspect each error log for permission failures, missing files, rewrite errors, or application startup problems.
- Test an intentionally unknown hostname that resolves to the server. It should land on the deliberately chosen default vhost, not expose a production site’s content.
Testing by IP address is not a substitute for testing by hostname. An IP-only request may not send the SNI name or the expected HTTP Host value, so Apache is allowed to use the default block.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFixing the wrong DocumentRoot
When the right certificate appears but the wrong site’s page loads, work through the selection chain in order. Change one variable at a time and repeat the request.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
1. Match the requested hostname exactly
Compare the browser’s address, including www and any other label, with every ServerName and ServerAlias. A misspelling, an omitted alias, or an alias assigned to another block leaves the request unmatched. Remember that the TLS name and HTTP host should identify the same site.
2. Confirm DNS reaches this Apache instance
Check A and AAAA answers and compare them with the server’s public addresses. If a record points to an old machine, no edit to this Apache configuration can change the response. Check split-horizon DNS and local resolver overrides when behavior differs between networks.
3. Confirm the listener and address group
The HTTPS block must use the address and port clients actually reach, commonly <VirtualHost *:443>. Verify that Apache listens on 443 and that a firewall or load balancer forwards that port to this process. A block on another address or port is not considered for the connection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Inspect vhost ordering
Use the distribution’s vhost-dump command, often apachectl -S, to see the order Apache parsed. The first block in the matching IP-and-port group is the fallback for names that do not match. Put an intentional, restricted default first; never rely on whichever file happened to sort first.
5. Verify the document root and authorization
Check that the directory exists, contains the expected file, and is readable and searchable by the Apache worker account. Ensure the <Directory> path exactly matches the root and includes an authorization rule such as Require all granted where public access is intended. A correct vhost can still return a 403 or a fallback application page when filesystem permissions are wrong.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
6. Separate certificate and content symptoms
If the certificate is for the correct domain but the page belongs to another domain, the TLS SNI selection worked and the problem is probably hostname matching, ordering, or the filesystem path. If the certificate itself belongs to another domain, investigate SNI support, the address-and-port group, and the default SSL vhost before debugging files.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make the default SSL vhost deliberate
Because unmatched names use the first SSL vhost, create a harmless default rather than allowing a real site’s content to become the catch-all. The default can return a minimal error response, deny access, or serve a neutral page. Keep it first in the parsed order and document that choice for future administrators.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Do not treat a default block as a substitute for configuring every legitimate hostname. Each production name still needs its own matching ServerName or ServerAlias, certificate coverage, and document root.
Choose the right multi-domain design
| Design choice | Advantages | Costs and limitations | Use it when |
|---|---|---|---|
| One shared IP with SNI and one certificate per domain | Conserves addresses and keeps certificates and filesystem roots independent. | Requires SNI-capable clients, Apache SSL support, and correct hostname presentation. | This is the normal modern arrangement for unrelated domains. |
| One shared IP with a wildcard or SAN certificate | Fewer certificate-selection objects and convenient coverage for several names. | All names covered by the certificate share its renewal and key-management scope; the vhost blocks are still required for separate content. | The names fit the certificate’s wildcard or SAN rules and a shared certificate lifecycle is acceptable. |
| Dedicated IP address per domain | Separates address groups and works around clients or infrastructure that cannot use SNI. | Consumes additional addresses and requires separate listener and DNS planning. | Legacy compatibility or strict network isolation justifies the extra addresses. |
| Separate ports | Provides explicit endpoint separation. | Users must include a nonstandard port, and firewalls, bookmarks, proxies, and application assumptions become more complicated. | Internal services or controlled clients can use a fixed port. |
| Shared document root | Simple for genuinely identical content. | Makes accidental cross-domain exposure and log attribution more likely; it does not solve certificate or hostname selection. | Only when the domains intentionally serve exactly the same site and policy. |
SNI is normally preferable to adding IP addresses or ports. A wildcard or SAN certificate changes certificate administration, not Apache’s need to map each hostname to the intended content.
Operational safeguards after the first deployment
- Keep certificates, private keys, and web content outside one another’s public paths. A key must never be reachable through a URL.
- Use a separate error and access log per vhost. During an incident, the selected log is often the fastest proof of which block handled a request.
- Review aliases whenever DNS changes. Remove aliases that no longer belong to the site, and do not copy an alias into a second vhost.
- Renew certificates before expiration and reload Apache only after validating the new paths and permissions.
- After every configuration change, run the syntax check, inspect the vhost map, and make one hostname-based HTTPS request.
- Keep the default vhost non-sensitive so a random or mistyped hostname cannot reveal a production application.
- Document which address, port, certificate, root, and service unit belong to each domain. This prevents a later administrator from editing a similarly named but inactive file.
Common symptoms and their likely causes
| Symptom | Most likely cause | First check |
|---|---|---|
| Every domain shows the same site | Names are not matching, or all requests are falling into the first vhost. | Compare hostnames with ServerName/ServerAlias and inspect apachectl -S. |
| The certificate is wrong before any page loads | SNI is missing or the request reached another address-and-port group. | Check the resolved address, port 443 listener, client SNI support, and first SSL vhost. |
| The certificate is right but files are wrong | The HTTPS block selected a different root, or the expected hostname is an unmatched alias. | Verify DocumentRoot, aliases, and the per-vhost access log. |
| HTTP redirects to the wrong HTTPS domain | The port-80 request matched another redirect vhost or uses an overly broad rule. | Inspect the HTTP vhost map and make each redirect target explicit. |
| Apache returns 403 for one site | The root is missing, inaccessible to the worker account, or lacks directory authorization. | Check the exact path, parent-directory permissions, and the matching <Directory> block. |
| Changes have no effect | The edited file is not included, the wrong service was reloaded, or a reload failed. | Run the syntax check, inspect the parsed vhosts, and confirm the active service and configuration path. |
When to use managed Apache hosting
If maintaining DNS, certificate renewals, vhost files, permissions, and reload procedures is outside your team’s responsibilities, managed Apache hosting can delegate those operations. Confirm in writing which party controls DNS, certificate issuance, private-key storage, custom vhost changes, log access, backups, and rollback. The same hostname-to-vhost rules still apply even when another provider performs the administration.
Quick Recap
Final deployment checklist
- Every public hostname resolves to the intended server on A and, if used, AAAA.
- Every hostname appears exactly once in an HTTPS
ServerNameorServerAliasset. - Each HTTPS block has the correct
DocumentRoot, certificate, key, logs, and matching<Directory>rule. - Apache listens on the address and port clients use, and SSL support is enabled.
- HTTP redirects are explicit and point to the intended canonical HTTPS name.
- The configuration passes its syntax check and the vhost dump shows the intended order.
- Hostname-based tests show the right certificate, page, and per-vhost log entry.
- The first SSL vhost is a deliberate, non-sensitive fallback.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
