iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Secure phpMyAdmin at the Apache layer, not inside phpMyAdmin itself. Use a hostname such as dbadmin.example.com, point DNS to the Ubuntu server, obtain a certificate for that exact name, enable TLS in the matching Apache VirtualHost, and use https://dbadmin.example.com/phpmyadmin/. A browser certificate protects the browser-to-Apache session; encrypting the separate Apache/phpMyAdmin-to-MySQL connection requires additional database TLS settings.
What this setup protects
When a user opens phpMyAdmin through an HTTPS URL, Apache negotiates TLS before phpMyAdmin receives the request. The certificate authenticates the hostname and encrypts login credentials, session cookies, SQL statements, and responses while they travel between the browser and Apache.
That protection ends at the web server. It does not automatically encrypt the connection from phpMyAdmin or PHP to MySQL or MariaDB. If the database is remote or traffic crosses a network you do not fully trust, configure database-link TLS separately; the relevant settings are covered later in this guide.
Prerequisites and naming decisions
Prepare these items before requesting a public certificate:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
- An installed Ubuntu server running Apache and phpMyAdmin.
- A registered domain or subdomain, for example
dbadmin.example.com. - An A record, and an AAAA record if you intend to serve IPv6, pointing the hostname to the correct server.
- An Apache VirtualHost whose
ServerNameis the same hostname users will enter. Add aServerAliasonly for additional names that will also be covered by the certificate. - Inbound TCP port 80 reachable from the internet while an HTTP-01 certificate request or renewal is being validated.
- Administrative access with
sudo, and permission to change firewall, Apache, DNS, and certificate settings.
Do not request a certificate until the hostname resolves to this server. A certificate for example.com does not cover an unrelated name such as dbadmin.example.com unless the latter appears in the certificate’s subject-alternative names.
Public and private hostnames
Let’s Encrypt is intended for names that can be validated through ACME. HTTP-01 requires the validation service to reach port 80. DNS-01 validates a DNS record instead and is the documented alternative when port 80 cannot be exposed or when a wildcard certificate is required. For an internal-only hostname that is not publicly resolvable, use DNS-01 with a suitable DNS provider or an internal certificate authority, then distribute that authority’s trust to the administrative clients.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsConfirm DNS, Apache, and the intended VirtualHost
Use the exact fully qualified domain name in every layer. In the site configuration, the HTTPS host should eventually contain a structure similar to this; keep an existing phpMyAdmin alias if the Ubuntu package already created one rather than defining it twice.
<VirtualHost *:443>
ServerName dbadmin.example.com
ServerAdmin admin@example.com
DocumentRoot /var/www/html
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/dbadmin.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/dbadmin.example.com/privkey.pem
Alias /phpmyadmin /usr/share/phpmyadmin
<Directory /usr/share/phpmyadmin>
Require all granted
</Directory>
</VirtualHost>The paths for the phpMyAdmin files can differ by package or installation method. The important points are that the alias is served by the intended HTTPS VirtualHost and that the certificate name matches ServerName and the URL.
Apache chooses a VirtualHost by the requested address and port. If no enabled host matches, the first or default VirtualHost can answer instead, presenting the wrong certificate or the wrong application. Check enabled sites and the HTTPS host before troubleshooting the certificate itself.
Enable Apache TLS support
Ubuntu provides the mod_ssl module and a default-ssl.conf example. Enable the module with:
Recommended Free Tools
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
sudo a2enmod sslYou may enable the packaged HTTPS site as a starting point:
sudo a2ensite default-sslFor a named site, replace default-ssl with that site’s file name, such as dbadmin-ssl. Ubuntu’s package-generated certificate is for testing only. Replace its certificate and key directives with files issued for the real hostname. If your certificate files are not under /etc/ssl/certs and /etc/ssl/private, point SSLCertificateFile and SSLCertificateKeyFile to their actual locations.
Do not copy a private key into an article, ticket, shell history, or chat transcript. Keep it readable only by the account and service that need it, and make a backup through your normal protected secrets process.
Obtain and install a trusted certificate with Certbot
For a public hostname, Certbot can request a certificate and update the matching Apache VirtualHost automatically. Ubuntu documents installation through the snap package:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo snap install --classic certbotMake sure Apache is already serving the named VirtualHost and that DNS and port 80 work before running the request. Then issue the certificate:
sudo certbot --apache -d dbadmin.example.comAdd another -d option only when that additional name resolves correctly and should appear on the same certificate:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
sudo certbot --apache -d dbadmin.example.com -d dbadmin.example.netThe Apache plugin finds the matching VirtualHost, adds TLS directives, and reloads Apache. The resulting live certificate files are normally in:
/etc/letsencrypt/live/dbadmin.example.com/fullchain.pem
/etc/letsencrypt/live/dbadmin.example.com/privkey.pemUse fullchain.pem as SSLCertificateFile; it contains the site certificate and intermediate chain expected by browsers. Use privkey.pem as SSLCertificateKeyFile. The symbolic links in the live directory are designed to follow renewed certificates, so avoid replacing them with a copied, dated file.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When Certbot cannot edit Apache
If your Apache layout is unusual or automatic editing is unsuitable, obtain the certificate without changing the web server:
sudo certbot certonly --webroot -w /var/www/html -d dbadmin.example.comThe webroot must be the directory that answers requests for /.well-known/acme-challenge/. After issuance, set the two certificate directives manually in the HTTPS VirtualHost, run an Apache configuration test, and reload Apache.
Standalone mode temporarily binds port 80. It therefore requires stopping whichever service currently owns that port and starting it again after validation. Webroot mode is usually less disruptive when Apache is already serving the site.
Keep phpMyAdmin on HTTPS
After issuance, open:
https://dbadmin.example.com/phpmyadmin/Confirm that the browser shows the expected hostname, a valid chain, and an unexpired certificate. If phpMyAdmin is available at another path, test that path under the HTTPS host. Do not assume that enabling the SSL module alone makes the application HTTPS-only; the alias must be present in the port-443 VirtualHost.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Keep an HTTP VirtualHost available for HTTP-01 validation, but redirect ordinary requests to HTTPS after the certificate is working. A typical port-80 host is:
<VirtualHost *:80>
ServerName dbadmin.example.com
DocumentRoot /var/www/html
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge/
RewriteRule ^ https://dbadmin.example.com%{REQUEST_URI} [R=301,L,NE]
</VirtualHost>This requires Apache’s rewrite module. The exception leaves the ACME challenge path reachable. If you use DNS-01 exclusively, the exception is not needed for validation, but retaining a simple HTTP host can make future configuration and diagnostics clearer. Do not redirect to a different hostname unless that name is also covered by the certificate and intentionally serves phpMyAdmin.
Test Apache and the certificate before relying on it
After every manual edit, validate the configuration before reloading:
sudo apache2ctl configtest
sudo systemctl reload apache2The first command must report a successful syntax check. A reload applies the new configuration without the interruption associated with a full stop and start. If the test fails, correct the reported file and line before reloading.
Check both schemes and the exact hostname:
- Request
http://dbadmin.example.com/phpmyadmin/and confirm it redirects to the HTTPS URL. - Request
https://dbadmin.example.com/phpmyadmin/and confirm the login page loads. - Enter the hostname directly in the browser; do not test only by IP address, because a certificate issued for a name will not match the IP.
- Inspect the certificate’s subject names and expiry date in the browser.
For a command-line view of the certificate selected through Server Name Indication, run:
openssl s_client -connect dbadmin.example.com:443 -servername dbadmin.example.com -showcertsReview the negotiated certificate and chain, and terminate the command with Ctrl-C. This is especially useful when Apache has several HTTPS VirtualHosts and the browser appears to receive a certificate from the wrong site.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Plan renewal instead of treating issuance as a one-time task
Let’s Encrypt certificates are valid for 90 days, according to Ubuntu’s current server documentation. Certbot installs a systemd timer that attempts renewal twice daily. The timer does not mean every attempt replaces the certificate; Certbot renews when the certificate is close enough to expiry under its normal policy.
Run the non-destructive renewal test immediately after setup:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →sudo certbot renew --dry-runA successful dry run confirms that the renewal method, challenge path, and account configuration can work without changing the live certificate. Treat a failed dry run as an operational defect, not as a warning to ignore.
When Certbot manages Apache, the integration reloads Apache after a successful renewal. If you maintain the certificate paths manually or another service consumes the certificate, add an appropriate deploy hook to reload that service after renewal. Otherwise, the files may be renewed on disk while the running process continues presenting the old certificate.
What to record
- The exact hostname and every alias included in the certificate.
- The enabled Apache site file containing the port-80 and port-443 VirtualHosts.
- The challenge method, webroot, DNS credentials or provider integration, and renewal timer.
- The command used for the dry run and where renewal logs are reviewed.
- The person or team responsible for responding to a failed renewal.
Configure TLS for the database connection separately
Browser HTTPS does not prove that the MySQL or MariaDB hop is encrypted. In phpMyAdmin’s server configuration, the database TLS options include:
PMA_SSL=1or$cfg['Servers'][$i]['ssl'] = true;to request an SSL/TLS database connection.PMA_SSL_VERIFY=1or$cfg['Servers'][$i]['ssl_verify'] = true;to verify the database server certificate.- A CA file setting so phpMyAdmin can build trust to the database certificate.
- Optional client-certificate and client-key settings when the database server requires client certificate authentication.
The exact environment-variable names and PHP configuration keys depend on how phpMyAdmin was installed, so place them in the configuration mechanism used by your package or container. Use a CA that represents the database server’s issuing authority and protect any client key as carefully as the Apache private key.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Disabling server-certificate verification weakens identity checking. phpMyAdmin’s documentation explicitly cautions that this configuration should be used only with care. Encryption without verification can prevent passive reading while still allowing an impersonating endpoint to present itself as the database server.
Choose the certificate method that fits the deployment
| Approach | Hostname and reachability | Apache changes | Renewal characteristics |
|---|---|---|---|
| Certbot Apache with HTTP-01 | Public DNS name; inbound port 80 available | Certbot finds the matching VirtualHost and installs TLS directives | Certbot timer attempts renewal twice daily; Apache is reloaded after successful managed renewal |
| Certbot webroot with HTTP-01 | Public DNS name; Apache can serve the challenge directory | You maintain the HTTPS directives and provide the correct webroot | Renewal is automated, but confirm the webroot remains reachable |
| DNS-01 validation | Useful when port 80 cannot be exposed or a wildcard is required; DNS control is necessary | Install the resulting files in the intended VirtualHost | Automate DNS updates where possible and test renewal independently |
| Internal certificate authority | Private-only names and administrative clients under your control | Install the internal certificate and key manually in Apache | Distribute the CA trust and operate renewal according to the authority’s policy |
The validation method and the browser-to-Apache encryption goal are separate decisions. A wildcard can simplify several subdomains, but it also expands the impact if its private key is exposed; use the smallest certificate name set that meets your administrative design.
Troubleshoot common failures
| Symptom | Likely cause | Checks and correction |
|---|---|---|
| ACME reports that the HTTP-01 challenge cannot be reached | DNS points elsewhere, port 80 is blocked, NAT forwards to another host, or the redirect hides the challenge path | Resolve the hostname from outside the server’s network, verify firewall and forwarding rules, and leave /.well-known/acme-challenge/ reachable. Use DNS-01 when port 80 cannot be exposed. |
| The browser says the certificate name is invalid | The URL, Apache ServerName, DNS name, and certificate SANs do not agree |
Use the exact issued hostname, add the required name with a new certificate request, and ensure the request reaches the matching VirtualHost. |
| A different certificate appears | Apache selected a different or default HTTPS VirtualHost | Inspect enabled sites and VirtualHost ordering, confirm the requested hostname, and place the intended ServerName on the correct port-443 host. |
| HTTPS loads Apache’s default page instead of phpMyAdmin | The phpMyAdmin alias exists only in the HTTP site or the wrong HTTPS site is active | Move or replicate the alias and its <Directory> permissions in the intended HTTPS VirtualHost, then run sudo apache2ctl configtest and reload. |
| Renewal succeeds but the old expiry date remains in the browser | Apache was not reloaded, or its directives reference a copied old certificate | Check the live paths, reload Apache, and configure a deploy hook when certificate files are maintained outside Certbot’s Apache integration. |
| A private hostname cannot obtain a public certificate | The name is not publicly resolvable or cannot satisfy HTTP-01 | Use DNS-01 with control of the domain’s DNS or use an internal CA and distribute its trust to the administrative clients. |
| The browser is secure but database traffic is not | Only the web-server TLS layer was configured | Configure phpMyAdmin’s database SSL, CA, verification, and optional client-certificate settings separately, then verify the database server’s own TLS policy. |
Final deployment checklist
- Choose one canonical hostname and create the required DNS records.
- Set Apache’s
ServerNameto that hostname and enable the intended site. - Confirm that port 80 reaches this server for HTTP-01, or select DNS-01/internal CA when that is more appropriate.
- Enable
mod_ssland obtain a certificate with Certbot or your chosen certificate authority. - Verify that the port-443 VirtualHost serves the phpMyAdmin alias and references
fullchain.pemandprivkey.pem. - Redirect ordinary HTTP requests to HTTPS without breaking an HTTP-01 challenge path.
- Run
sudo apache2ctl configtest, reload Apache, and test the real hostname and login flow. - Run
sudo certbot renew --dry-runand document how renewal reloads Apache. - If the database is remote or crosses an untrusted segment, configure and test phpMyAdmin’s database TLS independently.
- Keep private keys confidential and review certificate expiry and renewal failures as routine operations.
The Bottom Line
For an Ubuntu Apache installation, the reliable sequence is: point a real hostname at the server, enable TLS, issue a certificate for that exact name, serve phpMyAdmin from the matching HTTPS VirtualHost, preserve ACME validation, and test renewal. Configure database-link TLS separately when the MySQL or MariaDB connection also requires encryption and server identity verification.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
