shop.example.com is a separate address that has to exist in three places. Which one is missing is easy to tell from the symptom, and each has a different fix.

1. DNS

dig +short shop.example.com\n# nothing at all: the record does not exist

An A record pointing at the server, or a CNAME to a hostname that has one. Missing, the browser says the server cannot be found - the request never leaves the machine.

2. The server block

server {\n    listen 443 ssl;\n    server_name shop.example.com;\n    root /var/www/shop/public;\n}

With DNS in place and no matching server_name, the request arrives and Nginx serves whatever it considers the default site. That is the symptom where a subdomain shows the main site instead - and it means DNS is working.

3. The certificate

sudo certbot --nginx -d shop.example.com

With the first two right and no certificate for that name, the browser warns before it loads anything. The name has to be on the certificate; a certificate for example.com does not cover shop.example.com.

Where the files go

  • Its own directory - /var/www/shop/public. Clean, and the recommended shape.
  • A directory inside the main site - possible, and it means the main site can serve the same files at a second address unless you block it.
If the subdomain root sits inside the main document root, both addresses serve it. Either move it outside, or deny that path in the main server block - otherwise you have duplicate content and a staging site that search engines can find.

Wildcards

For many subdomains, one wildcard record and one wildcard certificate are less work - see wildcard subdomains.