Home / Docs / Server certificate install guide (Apache)

Server certificate install guide (Apache)

From CSR to preparing files, enabling mod_ssl, vhost config and backup.

Server certificate install guide (Apache)

The full flow on Apache httpd — from generating a request to installing and backing up.

1. Generate a private key and CSR

# private key
openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048

# certificate request
openssl req -new -key server.key -out server.csr

Fill in country, organization, Common Name (domain) etc., then submit server.csr for issuance. Back up server.key.

2. Prepare the certificate files

Unlike Nginx, Apache uses three separate files:

  • server.crt — the server certificate;
  • server.key — the private key;
  • chain.crt — the intermediate CA certificate.

3. Enable the SSL module

a2enmod ssl        # Debian/Ubuntu
apachectl configtest

On CentOS/RHEL make sure mod_ssl is installed (yum install mod_ssl).

4. Configure the virtual host

<VirtualHost *:443>
    ServerName www.yourdomain.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile      /etc/apache/ssl/server.crt
    SSLCertificateKeyFile   /etc/apache/ssl/server.key
    SSLCertificateChainFile /etc/apache/ssl/chain.crt

    SSLProtocol         all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite      HIGH:!aNULL:!MD5:!RC4
    SSLHonorCipherOrder on
</VirtualHost>

On Apache 2.4.8+ you may drop SSLCertificateChainFile and instead append the intermediate to the SSLCertificateFile file.

5. Redirect HTTP to HTTPS

<VirtualHost *:80>
    ServerName www.yourdomain.com
    Redirect permanent / https://www.yourdomain.com/
</VirtualHost>

6. Test and restart

apachectl configtest && apachectl -k restart

7. Backup & restore

Back up server.crt, server.key and chain.crt. To restore, put them back and restart Apache.

← Docs