Nginx or Apache on a VPS: DNS, Virtual Hosts and HTTPS Checklist

What this guide helps you do

A deployment checklist for getting a domain from DNS to a working web server and trusted TLS certificate. A website reaches the browser through several independent layers: public DNS, network firewall, web server listener, virtual host configuration, application files and TLS. Troubleshooting becomes much faster when you test those layers in order instead of changing them all at once. This guide is written for production-minded administrators and site owners: make a backup before material changes, keep credentials private, and prefer the controls supplied by your own hosting provider when its environment differs from a generic example.

Before you begin

Record the domain, server or station you are changing and the current working state. If the task touches DNS, SSH, firewall rules, databases, stream credentials or application configuration, make sure you have a recovery path first. Screens and menu names can vary between cPanel, AzuraCast, VDO Panel and Linux releases, so follow the purpose of each step rather than forcing an old screenshot onto a newer version.

Step 1: Point the domain’s A/AAAA records to the intended public address and verify resolution from outside the server. Remove stale IPv6 records if the service is not configured for IPv6.

Point the domain’s A/AAAA records to the intended public address and verify resolution from outside the server. Remove stale IPv6 records if the service is not configured for IPv6.

Step 2: Confirm the web server listens on 80 and, once configured, 443. Create a dedicated virtual host/server block for the hostname rather than relying on the default site.

Confirm the web server listens on 80 and, once configured, 443. Create a dedicated virtual host/server block for the hostname rather than relying on the default site.

Step 3: Validate configuration before reload: use nginx -t for Nginx or the appropriate apachectl/httpd configuration test for Apache. Fix syntax errors before touching TLS.

Validate configuration before reload: use nginx -t for Nginx or the appropriate apachectl/httpd configuration test for Apache. Fix syntax errors before touching TLS.

Step 4: Allow 80/443 through the operating-system and provider firewalls. Test a plain HTTP response externally before adding certificate automation.

Allow 80/443 through the operating-system and provider firewalls. Test a plain HTTP response externally before adding certificate automation.

Step 5: Issue a TLS certificate using a supported ACME/hosting workflow, then test HTTPS and only afterwards enable the canonical redirect from HTTP to HTTPS.

Issue a TLS certificate using a supported ACME/hosting workflow, then test HTTPS and only afterwards enable the canonical redirect from HTTP to HTTPS.

Useful commands or examples

The following commands are examples for the context described in this guide. Read them before running them, substitute your real service names or hostnames, and keep a working administrative session open for network or SSH changes.

getent hosts example.com
sudo ss -tulpn | grep -E ':80|:443'

# Nginx
sudo nginx -t

# Debian/Ubuntu Apache
sudo apachectl configtest

# RHEL-family Apache
sudo httpd -t

Verification checklist

Confirm public DNS, HTTP response, valid server configuration, firewall access, trusted certificate, correct virtual host and a single intentional HTTPS redirect. Also verify application-generated URLs use the preferred hostname. Always test from the user side as well as the administrator side. A control panel saying “active” is useful evidence, but it is not the same as an external browser, player or SSH client proving that the full path works.

Troubleshooting method

When the result is not what you expected, avoid changing several unrelated settings at once. Identify the last known-good point, collect the exact error message and determine which layer is failing: DNS, network, authentication, service process, application configuration, web/stream delivery or browser/player. Check timestamps and logs around the failure. If you need to escalate to hosting support, include the affected hostname or station, the time of the test, what you expected, what happened instead and the checks you already completed. Do not include passwords, API keys or private stream keys in a public ticket or screenshot.

Keep the system maintainable

Document the final configuration after it works. Note the important URLs, service names, backup locations, renewal/expiry dependencies and any change that would surprise another administrator. Revisit the setup after major platform upgrades because defaults, supported runtimes and interface labels evolve. A reliable environment is not one that was configured once; it is one whose current state is understood, monitored and recoverable.

Where to go next

Use the related guides below to expand the setup rather than solving the same problem from scratch. If the platform has outgrown shared hosting or you need managed implementation, the service recommendation at the bottom of this guide links to the most relevant hosting, streaming, development or optimisation option on this site.