iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To put app.example.com on an NGINX server, configure two separate layers: DNS must resolve the hostname to the correct server, and an NGINX server block must match that hostname and serve the right files or proxy traffic to the right application. HTTPS is a third step: obtain a certificate whose subject alternative names include the exact subdomain, configure the certificate and key in a TLS listener, then test and reload NGINX.
The sequence below works for a static site or an application running on a local port. Provider interfaces, Linux service managers, firewall rules and NGINX file layouts differ, so treat paths and commands as examples and verify each command’s output on your host.
What a subdomain setup actually changes
A subdomain is a hostname such as app.example.com. DNS does not serve web pages; it answers the question “which address should receive requests for this name?” NGINX then receives the request and chooses a virtual server by examining the listening address and port and the HTTP Host header.
NGINX describes the relationship this way: “Server names are defined using the server_name directive and determine which server block is used for a given request.” Its request-processing documentation adds that, in this configuration, NGINX tests the request’s Host header to determine which server should handle it. Consequently, a correct DNS record without a matching server_name can show the default site, while a perfect server block cannot help if the hostname resolves somewhere else.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
You normally create one of these arrangements:
- Static hosting: NGINX reads files from a directory using
rootand returns an index file. - Reverse proxying: NGINX accepts the public request and forwards it to an application listening on a local port or socket.
You can use an exact hostname for one subdomain, a wildcard name for a family of subdomains, or a regular expression for advanced routing. Matching precedence matters when several blocks could match, so avoid broad wildcards unless you intend them to catch every otherwise-unmatched name.
Prerequisites and decisions
Information to collect first
- The exact public hostname, for example
app.example.com, including spelling and punctuation. - The public IPv4 address for an
Arecord, and the IPv6 address for anAAAArecord if the server is reachable over IPv6. - Whether the subdomain serves files directly or forwards to an application.
- If proxying, the local upstream address and port, such as an application bound to
127.0.0.1:3000. The actual address, port and required headers are application-specific. - Administrative access sufficient to edit NGINX configuration, test it and reload the service.
- Firewall or cloud security-group access for TCP ports 80 and 443 when those ports are part of your service or certificate-validation method.
Choose the DNS record type
Use an A record when the hostname should resolve directly to an IPv4 address. Add an AAAA record when clients should use IPv6 and the server, firewall and NGINX listeners are configured for it. If another provider hosts the application, use that provider’s documented target; a CNAME may be appropriate when the provider asks for one. Do not create a CNAME and an address record for the same name unless your DNS provider explicitly supports the arrangement.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Step 1: Create DNS for the subdomain
Add the record at the authoritative DNS provider
- Open the DNS zone for
example.comat the provider that hosts its authoritative nameservers. - Create an
Arecord with host/nameapp(some interfaces require the full nameapp.example.com) and value equal to the server’s public IPv4 address. - If IPv6 is intentionally enabled, create an
AAAArecord for the server’s IPv6 address. - Save the record and note the configured TTL. DNS providers expose different fields and may append the parent domain automatically.
If the application is hosted elsewhere, enter the target documented by that provider instead of your NGINX server address. A DNS change is not proof that traffic has reached NGINX; verify resolution from the same deployment environment and from an external network.
Verify resolution before touching NGINX
Use a DNS lookup tool available on your workstation or server. For example:
dig +short app.example.com A
dig +short app.example.com AAAA
nslookup app.example.comThe returned address must be the address that should receive the request. If no answer appears, check the record name, authoritative nameservers and spelling. If an old address appears, check whether you edited a non-authoritative DNS panel or whether recursive resolvers still have the previous answer cached. Wait for the provider’s TTL and verify again rather than changing NGINX to compensate for incorrect DNS.
Step 2: Create an NGINX server block
NGINX virtual servers are declared with a server directive inside the global http context. A minimal HTTP block for a static site is:
Recommended Free Tools
server {
listen 80;
listen [::]:80;
server_name app.example.com;
root /var/www/app;
index index.html;
}The exact name in server_name must match the hostname clients send. Keeping listen 80 and listen [::]:80 together supports IPv4 and IPv6 when both are configured on the host. If IPv6 is not enabled, omit the IPv6 listener rather than advertising an unreachable address.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Prepare the static document root
- Create the directory named by
root, or change the directive to the directory that already contains the site. - Place an
index.htmlfile there, because the example’sindexdirective asks NGINX to use that filename for a directory request. - Ensure the NGINX worker user can traverse the parent directories and read the files. A permission problem can look like a missing page even when the file exists.
- Keep application secrets and private configuration outside the web root so that a misconfigured location cannot expose them as downloadable files.
Reverse-proxy an application instead
For an application listening locally, retain the hostname and listener but replace static delivery with a location / block. This is an illustrative pattern; substitute the address, port and headers required by your application:
server {
listen 80;
listen [::]:80;
server_name app.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}proxy_pass must point to a process that is actually listening. The correct forwarding headers depend on the framework and whether it needs to know the original scheme, host or client address. Configure trusted-proxy behavior in the application as well; forwarding a header does not by itself make the application trust it safely.
Step 3: Put the file where your distribution loads it
NGINX installations differ. Some distributions load files directly from a directory included by nginx.conf; others provide separate “available” and “enabled” directories and expect a symbolic link. Follow the layout already used on the server.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesOn a system using the common available/enabled pattern, a typical workflow is:
- Save the block as a new file such as
/etc/nginx/sites-available/app.example.com. - Create the enabled-site link in the distribution’s enabled directory, for example:
sudo ln -s /etc/nginx/sites-available/app.example.com /etc/nginx/sites-enabled/app.example.com - If your installation does not use those directories, place the file under the directory included by the
httpsection instead. Do not create a link to a path NGINX never includes.
Check the effective configuration includes the new file. A duplicate server_name, an unintended wildcard or an earlier default block can affect which server receives a request.
Step 4: Validate and reload NGINX safely
Test before every reload
Run the configuration test with the privileges needed to read certificates and included files:
sudo nginx -tProceed only when the command reports that the syntax test is successful and the configuration test is successful. If it reports an error, fix the file and run the test again. A reload with a syntax error can leave the running service unchanged or fail, depending on the service manager; never infer success from the command being typed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Reload through the operating system’s service manager
On a system using systemd, the usual command is:
sudo systemctl reload nginxOther operating systems may use a different service manager or an NGINX signal. Use the command that your installation documents, then inspect status and logs if the reload fails:
sudo systemctl status nginx
sudo journalctl -u nginx --since "10 minutes ago"Do not stop a working service merely to apply a configuration change. A successful reload keeps existing connections while workers pick up the validated configuration.
Step 5: Test HTTP routing and content
- Request the hostname, not the server’s bare IP address, so that the correct
Hostheader is sent:curl -i http://app.example.com/ - Confirm the response is generated by the intended static root or upstream application.
- For a static site, test a known file and a directory index. For a proxy, check the application logs as well as NGINX’s access and error logs.
- If DNS has not propagated but you need to test immediately, resolve the hostname to a specific address with a temporary local override or a curl resolution option. Remove the temporary override after testing so it does not hide a DNS error.
Seeing the main site usually means the request reached NGINX but did not match the intended server block. Check the exact hostname in the request, enabled configuration, listening port and competing names before changing the document root.
Step 6: Add HTTPS for the exact hostname
Obtain a certificate
The certificate must cover app.example.com in its subject alternative names. A certificate for only example.com does not automatically cover the subdomain. A wildcard certificate such as one covering *.example.com and wildcard DNS are separate choices: one controls certificate name coverage, the other controls DNS resolution. Configure each deliberately.
Certbot’s NGINX integration can obtain a certificate and modify supported NGINX configuration. Back up the NGINX configuration before allowing an automated change, and understand how to roll back the change. Before using HTTP-01 validation, ensure the requested hostname resolves to this validation server, inbound port 80 is reachable, and the challenge path can be served.
Keep an HTTP listener for HTTP-01 validation
HTTP-01 validation requests a file below /.well-known/acme-challenge/ over port 80. Redirecting ordinary HTTP traffic to HTTPS can be fine, but the challenge path must remain reachable and must not be blocked by an over-broad location rule. NGINX’s ACME guidance keeps a port-80 listener specifically for this purpose.
A practical sequence is:
- Run the DNS lookups again and confirm the hostname points to the server that will answer the challenge.
- Allow inbound TCP 80 for HTTP-01 and TCP 443 for the finished HTTPS service, in both the host firewall and any cloud security group.
- Run Certbot for
app.example.com, selecting the NGINX integration or a challenge mode appropriate to your deployment. - Inspect the certificate and key paths that Certbot reports. Do not assume a path until the files exist and have the expected permissions.
- Run
sudo nginx -t, reload NGINX, and openhttps://app.example.com/.
Do not claim renewal is working until a renewal test has actually completed successfully. A certificate can be valid today while a future renewal is blocked by DNS, firewall or challenge-path changes.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Configure a 443 TLS server block manually
If you install the certificate yourself, add a TLS virtual server such as:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name app.example.com;
ssl_certificate /etc/letsencrypt/live/app.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
root /var/www/app;
index index.html;
}For a reverse proxy, use the same location / and upstream settings from the HTTP block instead of root and index. The NGINX SSL module uses ssl_certificate and ssl_certificate_key for the virtual server. NGINX’s HTTPS guidance uses TLS 1.2 and TLS 1.3 as the default protocols in its example configuration; avoid enabling obsolete protocols unless a documented compatibility requirement exists.
Redirect HTTP after HTTPS is verified
Once the 443 block works and the certificate name is correct, the port-80 block can redirect normal requests:
server {
listen 80;
listen [::]:80;
server_name app.example.com;
location /.well-known/acme-challenge/ {
root /var/www/app;
}
location / {
return 301 https://$host$request_uri;
}
}Use a challenge location only when it matches the directory and validation method you selected. If Certbot manages the configuration, inspect its generated rules before adding a second redirect block that could conflict with them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How NGINX chooses the subdomain’s server block
Listener selection comes first
NGINX first considers the address and port on which the connection arrived. A request received on port 443 cannot be handled by a block that only listens on port 80. IPv4 and IPv6 listeners are also distinct; a client using IPv6 needs a reachable IPv6 address, firewall rule and matching listener.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Host header selects among matching listeners
After listener selection, NGINX compares the request’s Host value with server_name. An exact name such as app.example.com is the safest choice for one subdomain. Wildcards such as *.example.com can cover multiple names, while regular expressions support advanced cases. Exact, wildcard and regular-expression matching have documented priorities, so inspect all enabled blocks when a broad name captures traffic unexpectedly.
Do not confuse wildcard DNS and wildcard certificates
A wildcard DNS record controls where names resolve. A wildcard certificate controls which names a TLS handshake can authenticate. Neither replaces the other, and neither automatically creates an NGINX server block for each hostname. You still need deliberate routing and application behavior for every name you intend to serve.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Troubleshooting by symptom
| Symptom | Checks and corrective action |
|---|---|
| DNS lookup fails | Confirm the A, AAAA or CNAME record, authoritative nameservers and exact spelling of the hostname in server_name. |
| The main site appears | Check the request’s Host name, duplicate or wildcard server_name entries, listening address and port, and which configuration files are enabled. NGINX uses Host and server-name selection rules. |
| 404 from the new host | Check root, file permissions and the index filename. If the request should be proxied, verify that a location / with proxy_pass is being used instead of static-file delivery. |
| 502 Bad Gateway | Check that the upstream process is listening at the proxy_pass address and that local firewall rules or socket permissions allow NGINX to connect. |
| Certificate warning | Ensure the certificate’s subject alternative names cover the exact subdomain, the 443 block uses the matching certificate files, and the complete chain is installed. |
| ACME challenge failure | Confirm DNS points to the validation host, port 80 is reachable, and /.well-known/acme-challenge/ is not blocked or redirected incorrectly. |
Read the logs instead of guessing
The error log distinguishes a permission problem, missing file, failed upstream connection and TLS configuration error. The access log confirms which hostname, path and status code NGINX received. When troubleshooting, reproduce one request, note its timestamp, then inspect the corresponding entries. If no request appears, investigate DNS, firewall or an upstream load balancer before changing the server block.
Deployment checklists
DNS checklist
- The hostname is spelled identically in DNS tests and
server_name. - The A and, where intended, AAAA records point to reachable addresses.
- The authoritative nameservers are the ones you edited.
- External and deployment-environment lookups return the expected result.
NGINX checklist
- The file is inside a directory included by the
httpcontext. - The block has the required
listendirectives and exactserver_name. - Static sites have a readable root and index file; proxies have a reachable upstream.
sudo nginx -tsucceeds before reload.- The service manager reports a successful reload and logs show no new configuration error.
HTTPS checklist
- The certificate covers the exact subdomain.
- The 443 block references the intended certificate and private-key files.
- Port 443 is reachable, and port 80 remains reachable when HTTP-01 validation is used.
- The ACME challenge path is not blocked by a location rule or an incorrect redirect.
- A renewal test has been run before relying on automatic renewal.
Common design choices
Exact hostname versus wildcard matching
Choose an exact name when one subdomain has a distinct site, root or upstream. A wildcard can reduce repeated configuration when many subdomains genuinely share behavior, but it also increases the chance that a typo or unplanned hostname reaches the wrong service. Explicit blocks make ownership and troubleshooting clearer.
Free tools Windows power users keep installed
One-click scans. No signup required.
Static files versus reverse proxy
Static delivery has fewer moving parts: NGINX reads files and returns them. Reverse proxying is required when an application generates responses, but it introduces an upstream process, health and socket permissions, forwarded-header behavior and an additional source of 502 errors. Decide based on how the application produces content, not on the DNS record type.
Individual versus wildcard certificates
An individual certificate limits coverage to the names requested and can reduce the impact of exposing a private key for unrelated hosts. A wildcard certificate can cover multiple subdomains but requires careful certificate issuance and DNS strategy. In both cases, verify the certificate’s actual subject alternative names rather than relying on its filename.
Manual versus Certbot-managed installation
Manual installation gives direct control over file locations and server blocks, while Certbot can obtain certificates and modify supported NGINX configurations. Back up configuration before automated edits, inspect the resulting blocks, and test renewal instead of assuming that initial issuance proves the entire lifecycle works.
When managed hosting changes the workflow
On a managed web host or managed DNS service, you may not control NGINX files, listeners or certificate paths. The provider may ask you to create a CNAME or point an A record to a documented target, then add the subdomain in its control panel. Use the provider’s exact target and validation instructions; do not copy a self-managed VPS path such as /etc/nginx/sites-available into a platform that does not expose NGINX.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOn a self-managed VPS, you remain responsible for DNS, firewall access, NGINX configuration, upstream processes, certificate issuance and renewal. Keeping those responsibilities separate makes failures easier to locate: DNS determines where a name goes, NGINX determines which virtual server answers, and the application determines what the proxy returns.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
