Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMove an SSL certificate to an Ubuntu VPS by transferring the leaf certificate, private key, and any intermediate chain over an encrypted administrative connection; storing them with restrictive permissions; pointing the correct Apache <VirtualHost *:443> at those files; then running an Apache syntax test before reloading. For a Certbot-managed certificate, use the files in /etc/letsencrypt/live/<certificate-name>/—especially fullchain.pem and privkey.pem—so future renewals continue to work.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you must move
An HTTPS installation has three related pieces:
- The leaf/server certificate, usually a
.crtor PEM file, whose subject and Subject Alternative Names cover the domains served by Apache. - The private key that was generated for that certificate.
- The issuer’s intermediate certificate or bundle, when it is supplied separately. Clients need this chain to build trust to a root certificate.
A certificate cannot simply be copied without its matching private key. Likewise, copying only the leaf certificate can leave browsers and other clients with an incomplete chain. Treat the private key as a secret throughout the migration.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose the migration method first
The correct procedure depends on who will renew the certificate after the move. A manually issued certificate remains your responsibility: you transfer the files, edit Apache, and arrange future replacement yourself. A Certbot-managed certificate should keep Apache pointed at Certbot’s stable live paths, which are updated when renewal creates newer files.
| Area | Manual certificate | Certbot-managed certificate |
|---|---|---|
| Who renews it | You or the issuing service’s own renewal process. | Certbot, normally through its scheduled renewal service. |
| Apache configuration | You set the certificate and key directives in the matching SSL VirtualHost. | The Apache plugin can find the matching VirtualHost, add TLS directives, and reload Apache. |
| Typical storage | Certificate and chain under /etc/ssl/certs/; private key under /etc/ssl/private/. |
/etc/letsencrypt/live/<certificate-name>/, with fullchain.pem and privkey.pem references. |
| Reload after renewal | Use a renewal deploy hook or your own operational process. | The Apache integration can reload Apache; verify that behavior on the new VPS. |
| Validation choices | Depends on the issuer and its renewal system. | HTTP-01 needs DNS pointing to the VPS and reachable port 80; DNS validation is an alternative when port 80 cannot be exposed. |
| Key permissions | Set ownership and modes that let Apache read the key without making it world-readable. | Retain Certbot’s restrictive permissions, adjusting group access only when the Apache process needs it. |
Prepare and inventory the old server
Identify every input file
Before copying anything, locate the certificate, its private key, and the intermediate chain or bundle. Record which Apache site uses them and which hostnames it serves. A certificate may cover several names through its Subject Alternative Name extension, so compare those names with the VirtualHost’s ServerName and ServerAlias values.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
You can inspect a certificate without exposing the key:
openssl x509 -in /path/to/server.crt -noout -subject -issuer -dates -ext subjectAltNameCheck the result for the intended hostnames and expiry date. Do not print the private-key file or paste its contents into a ticket, chat message, or command that will be retained in shell history.
Back up the old configuration
Keep a copy of the old certificate paths and the relevant Apache site configuration until the new endpoint has passed an HTTPS check. This gives you a practical rollback: restore the previous directive paths, run the syntax test, and reload Apache on the old or new host as appropriate.
Transfer the files securely
Use an authenticated, encrypted administrative channel such as scp (or an equivalent controlled transfer). Transfer the certificate, key, and chain as separate files when they are separate on the old host:
scp /path/to/server.crt admin@new-vps:/tmp/server.crt
scp /path/to/server.key admin@new-vps:/tmp/server.key
scp /path/to/intermediate-chain.pem admin@new-vps:/tmp/intermediate-chain.pemThe temporary destination above is only an example. If you use a staging directory, restrict it immediately, avoid shared or world-readable locations, and remove temporary copies after installation. Never transmit a key through unencrypted email, a support ticket, chat, or a command-line argument that could be logged.
After transfer, compare checksums or otherwise verify that the files arrived intact. The key itself must remain confidential; integrity checks should not require publishing it.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Install a manually issued certificate on Ubuntu Apache
1. Place files in protected directories
Ubuntu commonly uses /etc/ssl/certs/ for certificates and /etc/ssl/private/ for private keys. The Apache directives can use other absolute paths, but these locations make the intended protection clear.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo install -o root -g root -m 0644 /tmp/server.crt /etc/ssl/certs/example.com.crt
sudo install -o root -g root -m 0644 /tmp/intermediate-chain.pem /etc/ssl/certs/example.com-chain.pem
sudo install -o root -g root -m 0600 /tmp/server.key /etc/ssl/private/example.com.keyThe exact key mode depends on how your Apache service starts and drops privileges. If Apache must read the key after startup, use the service’s designated group and a restrictive mode such as 0640, for example:
sudo chown root:<apache-group> /etc/ssl/private/example.com.key
sudo chmod 0640 /etc/ssl/private/example.com.keyReplace <apache-group> only after confirming the group used by your distribution and service. Do not solve a permission error by making the key world-readable. Check directory traversal permissions as well as the file’s mode.
2. Enable TLS support and the intended site
Enable Apache’s SSL module and the site configuration that contains the HTTPS VirtualHost:
sudo a2enmod ssl
sudo a2ensite your-site-ssl.confUbuntu’s documented default-site example uses:
sudo a2ensite default-sslEnabling a site does not guarantee that it will answer for the hostname you expect. The active configuration must contain a matching ServerName or ServerAlias.
3. Edit the matching port-443 VirtualHost
Open the enabled site and find the block for HTTPS, normally written as <VirtualHost *:443>. Set the certificate and key directives to absolute paths:
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
SSLEngine on
SSLCertificateFile /etc/ssl/certs/example.com.crt
SSLCertificateKeyFile /etc/ssl/private/example.com.key
</VirtualHost>When your issuer supplied a single full-chain file, use that file as SSLCertificateFile. Modern Apache normally expects the server certificate followed by its intermediate certificates in that file. Older Apache versions may require a separate certificate-chain directive; follow the syntax supported by the version installed on the VPS rather than copying a directive that it does not recognize.
If you have separate leaf and chain files and your Apache version supports only the older arrangement, configure the chain exactly as documented for that version. Supplying only the leaf certificate is a common reason some clients report an incomplete chain.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
4. Test before touching the live listener
Run Apache’s configuration test and read every line of its output:
sudo apachectl configtestDo not reload until the result is successful. Correct misspelled paths, unreadable keys, missing modules, duplicate VirtualHost definitions, and syntax errors first. A successful test means Apache can parse the configuration; it does not by itself prove that the right hostname will receive the right certificate.
5. Reload and verify from the client side
Apply the change with a graceful reload where supported:
sudo systemctl reload apache2Use a full restart only when your service arrangement requires it. Then connect to the exact public hostname over HTTPS and check:
- The certificate subject and Subject Alternative Names contain the hostname you tested.
- The served chain includes the required intermediate certificate.
- The expiry date is the expected one.
- The response comes from the new VPS and not an old server, proxy, or differently configured VirtualHost.
Move a Certbot-managed certificate
Find the certificate name and covered domains
On the new VPS, list Certbot’s managed certificates:
sudo certbot certificatesNote the certificate name and domain list. Certbot-managed files normally appear under:
/etc/letsencrypt/live/<certificate-name>/The important files for Apache are:
fullchain.pem: the server certificate followed by the intermediate certificates.privkey.pem: the matching private key.
The live directory is the stable reference. Certbot updates its links when a renewal creates a new certificate, so do not point Apache at a dated file in an archive directory.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Let Certbot install or configure the certificate
If you are obtaining the certificate on the new VPS and want Certbot to edit Apache, use the Apache-integrated flow:
sudo certbot --apache -d example.com -d www.example.comCertbot’s Apache plugin searches for the VirtualHost matching the requested domains, adds the necessary TLS directives in place, and reloads Apache. Review the resulting site configuration and test the exact hostnames afterward.
If you want Certbot to obtain or renew the certificate without editing Apache, use the certonly approach and configure the VirtualHost yourself. The resulting directives should look like:
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pemIf you are moving an already-issued certificate rather than obtaining a new one, preserve the Certbot directory and renewal configuration carefully. A fresh issuance may be simpler when the old server cannot be transferred safely, but validation still has to succeed against the new VPS.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Check renewal before declaring the migration complete
Run a dry renewal test:
sudo certbot renew --dry-runThis exercises the renewal configuration without saving a live replacement. Confirm that the renewal method can reach the new VPS. HTTP-01 validation requires DNS to point at the VPS and port 80 to be reachable. If the deployment cannot expose port 80, use a DNS validation method supported by the certificate configuration.
Ubuntu documents a systemd renewal timer and automatic Apache reload for certificates installed through the Apache plugin. Verify that the timer exists and that a successful renewal causes Apache to reload. For a manually configured Apache service, attach a renewal deploy hook that reloads Apache only after a successful renewal, such as:
sudo certbot renew --deploy-hook 'systemctl reload apache2'Use the hook in the scheduler or renewal configuration appropriate to your installation rather than running a one-off command that will not execute on the next renewal.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Verify that the certificate and key match
A copied certificate and key can each be valid while belonging to different pairs. Before reloading, compare their public-key fingerprints with OpenSSL. One practical method is to derive a public key from each input and compare the resulting digest:
Recommended Free Tools
openssl x509 -in /etc/ssl/certs/example.com.crt -pubkey -noout | openssl pkey -pubin -outform DER | openssl sha256
openssl pkey -in /etc/ssl/private/example.com.key -pubout | openssl pkey -pubin -outform DER | openssl sha256The digests should match. Run these commands with permissions that allow the key to be read, and do not publish their surrounding key material. For a Certbot installation, substitute the fullchain.pem certificate path and privkey.pem key path.
Security checks after the move
- Keep the private key owned by root and readable only by root and the specific Apache service group when necessary.
- Check every parent directory for traversal permissions; a locked file inside an accessible directory is not a complete protection plan.
- Remove staging copies from temporary directories after installation.
- Search operational notes and shell history for accidentally pasted key contents and remove exposed material according to your incident procedure.
- Retain the old certificate and configuration backup only where access is controlled, and delete it when your rollback window ends.
Certbot applies restrictive default permissions. If Apache drops root privileges before opening the key, its group membership and a mode such as 0640 may be required. Adjust access narrowly rather than granting read permission to all users.
Troubleshoot the common failure modes
Apache cannot read the private key
Inspect the key’s owner, group, mode, and every parent directory. Confirm that the Apache process can traverse the directories and read the file after privilege drop. Check mandatory-access-control logs if your host uses them. Correct the specific ownership or mode problem; do not use chmod 644 or another world-readable setting on a private key.
The browser reports an incomplete chain
Verify that SSLCertificateFile points to a full-chain file, or configure the issuer’s intermediate chain using the directive required by your Apache version. A leaf certificate alone may work for some clients and fail for others that do not already have the intermediate cached.
The wrong certificate is served
List enabled sites and inspect all port-443 VirtualHosts. Check the ServerName and ServerAlias matching for the exact hostname, then test that hostname rather than the server’s IP address. A different enabled site, a duplicate alias, or a DNS record still pointing at the old VPS can make a correct certificate appear to be missing.
Renewal succeeds but clients still see the old certificate
Confirm that Apache references Certbot’s live path rather than a dated archive file. Then verify that Apache reloads after renewal and that the reload succeeds. A renewed file on disk does not change the certificate already held by running worker processes until Apache has reloaded or restarted.
Certbot HTTP validation fails
Check that the domain’s DNS records resolve to the new VPS and that inbound port 80 is reachable from the public internet. If policy or network design prevents exposing port 80, configure DNS validation instead and ensure the required DNS record can be created during renewal.
Apache fails its syntax test after editing
Read the first reported error, check the referenced file and line, and rerun sudo apachectl configtest after each correction. Typical causes during a move are a path copied with the old server’s directory structure, a missing SSL module, an unreadable key, or a chain directive unsupported by the installed Apache version.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rollback plan
- Stop changing files while you determine whether the failure is certificate selection, permissions, chain construction, or DNS.
- Restore the previously known-good certificate and key paths in the affected VirtualHost, or restore the prior configuration backup.
- Run
sudo apachectl configtestand fix any error it reports. - Reload Apache with
sudo systemctl reload apache2when the test succeeds. - Check the old endpoint and certificate before attempting the migration again.
Keep the rollback copy until the new HTTPS endpoint, chain, hostname coverage, and renewal dry run have all been checked. Once those checks pass, remove obsolete private-key copies from the old system and transfer locations.
Quick Recap
Migration checklist
- Leaf certificate, matching private key, and required intermediate chain identified.
- Subject Alternative Names checked against every Apache hostname.
- Files transferred through an encrypted, authenticated channel.
- Certificate and chain stored under protected certificate paths; key stored under a protected private path.
- Apache SSL module and intended HTTPS site enabled.
- Correct
SSLCertificateFileandSSLCertificateKeyFilepaths entered in the matching port-443 VirtualHost. sudo apachectl configtestpasses before reload.- Exact public hostnames tested for certificate, chain, expiry, and server identity.
- Certbot configurations use
/etc/letsencrypt/live/<certificate-name>/rather than dated archive files. sudo certbot renew --dry-runpasses, and a post-renewal Apache reload is confirmed.- Old files and configuration remain protected until rollback is no longer needed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
