Host Multiple Domains with SSL on One VPS

Hosting multiple websites on a single VPS is a smart way to save money and keep all your projects in one place. With a web server like Nginx or Apache, you can serve different domains from the same IP address, and with Let’s Encrypt, you can secure each one with a free SSL certificate. This guide walks you through the entire process, from installing the server software to setting up automatic SSL renewal.

What You’ll Need

• A VPS running Linux (Ubuntu 20.04 or 22.04 recommended) with root or sudo access.
• Two or more domain names that point to your VPS’s IP address (via A records).
• Ports 80 and 443 open in your firewall.

Step-by-Step

1. Update your system. SSH into your VPS and run sudo apt update && sudo apt upgrade -y to ensure all packages are current.
2. Install Nginx. Run sudo apt install nginx -y. Nginx is lightweight and handles multiple domains well. Start it with sudo systemctl start nginx and enable it on boot with sudo systemctl enable nginx.
3. Create directory structure. For each domain, create a separate web root. For example, for example.com and example.org:

sudo mkdir -p /var/www/example.com/html
sudo mkdir -p /var/www/example.org/html

4. Set permissions. Give your user ownership so you can upload files without sudo:

sudo chown -R $USER:$USER /var/www/example.com/html
sudo chown -R $USER:$USER /var/www/example.org/html

5. Add a test page. Create an index.html in each directory with a simple message like <h1>Welcome to example.com</h1>.
6. Create server blocks. Nginx uses server blocks to route requests. Create a config file for each domain:

sudo nano /etc/nginx/sites-available/example.com

Paste the following, adjusting the server_name and root:

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com/html;
    index index.html;
}

Repeat for the second domain.

7. Enable the sites. Create symlinks in sites-enabled:

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/example.org /etc/nginx/sites-enabled/

8. Test and reload. Run sudo nginx -t to check for syntax errors. If it says “syntax is ok”, reload Nginx with sudo systemctl reload nginx.
9. Install Certbot. Certbot is the tool that gets and manages Let’s Encrypt certificates. Install it with:

sudo apt install certbot python3-certbot-nginx -y

10. Obtain SSL certificates. Run Certbot for each domain. It will automatically edit your Nginx config to enable HTTPS:

sudo certbot --nginx -d example.com -d www.example.com
sudo certbot --nginx -d example.org -d www.example.org

Follow the prompts: enter your email, agree to the terms, and choose whether to redirect HTTP to HTTPS (recommended).

11. Verify auto-renewal. Let’s Encrypt certificates expire every 90 days. Certbot installs a systemd timer that runs twice a day. Check it with sudo systemctl status certbot.timer. You can do a dry run with sudo certbot renew --dry-run.
12. Repeat for additional domains. For any new domain, just create the web root, add a server block, enable it, and run Certbot again.

Common Mistakes

• Forgetting the www subdomain. If you don’t include www in the Certbot command, the certificate won’t cover it, and visitors to www will see a warning.
• DNS not propagated. If your domain doesn’t point to the VPS IP, Certbot will fail. Check with dig example.com to confirm.
• Blocking port 80. Certbot needs port 80 open for the HTTP-01 challenge. If your firewall blocks it, the certificate issuance fails.
• Using the same root for multiple domains. Each domain should have its own directory to avoid serving the same content.
• Editing the default config. Don’t put your server blocks in /etc/nginx/sites-available/default; it can cause conflicts.

Tips

• Use a wildcard certificate. If you have many subdomains, a wildcard like *.example.com covers them all, but it requires DNS-01 challenge, which is more complex.
• Set up a redirect to HTTPS. Certbot can do this for you, but you can also add a permanent redirect in your server block if you prefer manual control.
• Keep your server blocks organized. Name files after the domain and use comments to remember which is which.
• Monitor your certificates. Use a service like UptimeRobot or a simple cron job to check expiration dates.
• Use a firewall. Only allow ports 22, 80, and 443. Tools like UFW make this easy.

Troubleshooting

• Certbot fails with “No domain names were found.” Ensure your server block has the correct server_name and that Nginx is running.
• “The certificate could not be installed.” This usually means Nginx can’t find the server block. Run sudo nginx -t to see errors.
• HTTPS works but HTTP doesn’t redirect. Check that Certbot added the redirect line. If not, add it manually: return 301 https://$host$request_uri; inside the port 80 server block.
• SSL certificate shows as invalid. Wait a few minutes for DNS to propagate, then check with openssl s_client -connect example.com:443.
• One domain works, another doesn’t. Verify that the second domain’s DNS points to your VPS and that its server block is enabled.

Frequently Asked Questions

Can I host unlimited domains on one VPS?

Yes, as long as your VPS has enough resources (RAM, CPU, bandwidth) to handle the traffic. Nginx can serve hundreds of sites with modest hardware.

Do I need a separate IP for each SSL certificate?

No, thanks to SNI (Server Name Indication), you can have multiple SSL certificates on one IP address. All modern browsers support SNI.

What if my domain uses a different port?

SSL typically uses port 443. If you need a custom port, you can add listen 8443 ssl; in the server block, but Certbot may not handle it automatically.

How do I add a new domain later?

Repeat steps 3-10: create the directory, add a server block, enable it, reload Nginx, and run Certbot for that domain.

Can I use Apache instead of Nginx?

Yes, the process is similar. Install Apache, create virtual hosts, and use sudo apt install certbot python3-certbot-apache to get certificates.

What happens when my certificate expires?

If auto-renewal fails, your site will show a security warning. Check the certbot timer and logs at /var/log/letsencrypt/letsencrypt.log to see what went wrong.

Related

• PGP Web of Trust: What Key Signatures Prove
• Wizard Alchemy Chest Locations Guide
• Ireland vs UK for Starting an AI Company: How to Choose