How to Install an SSL Certificate: Apache

Installing an SSL certificate on Apache involves three main stages:

• Generating a certificate signing request (CSR) and completing validation
• Receiving the certificate from GeoTrust
• Configuring Apache to serve your site over HTTPS

When done correctly, visitors see the secure padlock in their browser, and data travels encrypted between client and server.

Prepare Your Server

Before working with certificates, ensure Apache and the SSL module are properly installed and enabled. On most Linux distributions, Apache 2.4 includes SSL support through the mod_ssl module. Verify it’s loaded by checking for a line like LoadModule ssl_module modules/mod_ssl.so in your main Apache configuration or modules file, or run this command:

apachectl -M | grep ssl

Confirm whether you already have an SSL configuration file, often named yourdomain.conf or ssl.conf and found in locations such as /etc/apache2/sites-enabled/default-ssl.conf or /etc/httpd/conf.d/ssl.conf, depending on your platform.

You’ll also want to decide where to store your private key and certificate files. Standard practice is to use directories like /etc/ssl/private/ for keys and /etc/ssl/certs/ for certificates, with permissions restricted so only root can read the private key.

Step 1: Generate a Private Key and CSR

To obtain a trusted SSL certificate, you must generate a private key and a CSR using OpenSSL. Connect to your server over SSH and run a command similar to:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

This creates an unencrypted private key file (yourdomain.key) and a CSR file (yourdomain.csr) in the current directory. During the process, OpenSSL prompts for details such as country, organization, and common name (CN), the fully qualified domain name you want to secure (for example, www.example.com).

Keep the private key file safe and never share it with anyone. Only the CSR content is submitted to GeoTrust. You can open the CSR in a text editor and copy all text between the —–BEGIN CERTIFICATE REQUEST—– and —–END CERTIFICATE REQUEST—– tags when requesting your certificate. You’ll then need to follow the instructions provided to complete validation.

Step 2: Receive and Organize Certificate Files

After the certification authority (CA) validates your request, you receive your server certificate and one or more intermediate certificates that form a chain of trust. Download the issued certificate file (often named after your domain, such as yourdomain.crt) along with the intermediate or CA bundle file (ca-bundle.crt or similar).

Copy these files to your certificate directory on your server, keeping the naming clear and consistent. You should now have yourdomain.crt, yourdomain.ca-bundle.crt, and the existing yourdomain.key file in place.

Step 3: Configure Apache for HTTPS

Once the key and certificate files are ready, configure an Apache SSL VirtualHost to serve traffic over port 443. Open the appropriate configuration file, such as /etc/apache2/sites-enabled/default-ssl.conf or your site’s VirtualHost file. Look for a block like <VirtualHost *:443> or create one by copying your existing port 80 VirtualHost and changing the port to 443.

Inside the SSL VirtualHost, include these following directives pointed to your actual files:

SSLEngine on
SSLCertificateFile /path/to/yourdomain.crt
SSLCertificateKeyFile /path/to/yourdomain.key
SSLCertificateChainFile /path/to/yourdomain.ca-bundle.crt

Note: on Apache 2.4.8+, instead of using SSLCertificateChainFile, concatenate the intermediate/CA bundle file into the SSLCertificateFile:

cat yourdomain.com.crt yourdomain.ca-bundle.crt > yourdomain.com-bundle.crt

Check that the ServerName matches the domain on the certificate and verify that the DocumentRoot points to the correct site directory.

Step 4: Test and Reload Apache

Before restarting, validate the configuration to catch syntax errors or path mistakes. Run the Apache configuration test with apachectl configtest or apache2ctl configtest, depending on your system. A response of “Syntax OK” indicates that Apache parsed the configuration successfully.

If the test passes, restart Apache with systemctl restart apache2 or systemctl restart httpd so the changes take effect.

Finally, visit https://yourdomain in a browser and confirm that the connection is reported as secure and the certificate details match your domain.

Troubleshooting Tips

If you encounter issues, check these common problems:

• Verify all file paths are correct
• Ensure the private key matches the certificate
• Confirm the CA bundle is complete
• Check file permissions allow Apache to read the certificate files.

Most configuration errors appear in Apache’s error log, typically found in /var/log/apache2/ or /var/log/httpd/.