How to Install an SSL Certificate on Debian (Apache2) 

As a website owner, using HTTPS is essential to securing user data, improving SEO, and gaining visitor trust. In this guide, you’ll learn how to manually install and configure an SSL certificate on Debian and how to automate the process using GeoTrust Horizon AutoInstall SSL.

• The manual method suits users who want full control over files and configuration.
• SSL automation offers a simple, beginner-friendly option for users who want to set their server certificate installation tasks on autopilot.

Start by Getting an SSL Certificate

You’ll need a valid SSL/TLS certificate before starting. You can choose from a range of domain validation (DV), organization validation (OV), extended validation (EV), multi-domain, and wildcard certificates from publicly trusted certificate authorities (e.g., GeoTrust).

How to Manually Install an SSL Certificate on Apache2 (Debian)

Note: In the following steps, replace the example placeholder values (e.g., securitytest_site.key and securitytest_site.csr) with your domain’s unique values.

Step 1: Generate a Private Key and CSR

Begin by generating a private key on your server, which will be used to generate a certificate signing request (CSR). For this example, the following OpenSSL command will create a private key for the domain securitytest.site:

sudo openssl genrsa -out /etc/ssl/private/securitytest_site.key 2048

Next, create the CSR:

sudo openssl req -new -key /etc/ssl/private/securitytest_site.key -out /etc/ssl/certs/securitytest_site.csr 

This command will bring up a list of fields for you to complete regarding your domain and organization:

To display your CSR information in a readable text format, use the command (while replacing our placeholder filepath and filename values with your own):

openssl -in /etc/ssl/certs/securitytest_site.csr

Submit the CSR to your chosen certificate provider. For this step, if you’ve purchased a certificate through our website, you can submit the CSR via the GeoTrust Horizon dashboard when enrolling for your certificate:

• navigate to All Orders (as shown below),
• find your specific certificate order, and
• hit the Generate Certificate button to get started.

Follow the subsequent prompts to launch the Certificate Enrollment and domain validation processes:

• Specify the domain for the SSL/TLS certificate.
• Select the Manual Installation method.
• Enter your certificate signing request information.
• Verify your domain information matches.
• Read and accept the subscriber agreement terms and conditions.

Step 2: Validate Your Domain

The validation process must be completed before your certificate will be issued.

GeoTrust Horizon supports several methods of domain control validation (DCV), including HTTPS-based validation, which is fast and easy to use. (Note: File-based validation is not supported for wildcard SSL/TLS certificates, as this validation method is not permitted for wildcards by the industry’s security baseline requirements.)

Before starting the validation process, you must first provide domain contact information and submit your certificate request to complete the certificate enrollment process.

After initiating domain validation, retrieve a specific .txt validation file from the certificate provider. This information is available in GeoTrust Horizon dashboard, in the Certificate Validation Process section.

Upload the file to the directory specified in your account’s GeoTrust Horizon dashboard. On Debian Apache2, you can do this in the directory:

/var/www/html/.well-known/pki-validation/

If this directory doesn’t exist yet, you can create it using the following example commands. (Remember to swap out the generic values here for yours as specified in the GeoTrust Horizon dashboard!):

sudo mkdir -p /var/www/html/.well-known/pki-validation/
sudo nano /var/www/html/.well-known/pki-validation/filename.txt

Paste in the contents and save your changes (using CTRL + O > Enter > CTRL + X). Next, enable SSL and restart Apache using the following commands:

sudo a2enmod ssl
sudo systemctl restart apache2 

Once this step is complete, you’ll want to visit the validation URL in your browser to confirm the changes have taken effect. If you see a message like the following (below), go back to your GeoTrust Horizon screen and click Request Verification (as shown in Step 4 in the previous screenshot).

Step 3: Download, Upload, and Organize Your Certificate Files

After validation, download the issued certificate files from your certificate provider. (Again, if you’ve bought one of our certificates, you can do this in GeoTrust Horizon.) You’ll receive the following files (with customized file names for your domain) in a .zip file:

• securitytest_site.crt
• My_CA_Bundle.ca-bundle

Use the secure copy protocol (SCP) to upload these files to your Debian server. (Reminder: Swap out our generic placeholder info with your specific file names in the following command.):

scp -i your-key.pem example.com.crt ca_bundle.ca-bundle user@server_ip:/home/user

Then, move them to Apache’s certificates folder:

sudo mv /home/user/example.com.crt /etc/ssl/certs/
sudo mv /home/user/ca_bundle.ca-bundle /etc/ssl/certs/

Note: Apache, unlike NGINX, conveniently doesn’t require you to create a combined chain certificate file.

Verify your permission settings to ensure the files are secure and readable by Apache:

sudo chmod 644 /etc/ssl/certs/example.com.crt /etc/ssl/certs/My_CA_Bundle.ca-bundle

Step 4: Enable Apache’s SSL Module and Configure Your HTTPS Virtual Host (Debian/Ubuntu)

To enable required modules (and reload Apache), use the following commands:

sudo a2enmod ssl
sudo a2enmod headers     # recommended for HSTS and security headers
# The following is optional but common if you use redirects/rules:
sudo a2enmod rewrite
sudo systemctl reload apache2

• If a module is already enabled, Apache will say so.
• Enabling ssl also ensures Apache listens on port 443 (via ports.conf).

Edit your site’s existing SSL configuration file. (Reminder: Replace the generic values with your unique values):

sudo nano /etc/apache2/sites-available/default-ssl.conf

Or, better still, create a new config file that’s specific to your domain using the second command:

sudo nano /etc/apache2/sites-available/securitytest_site.conf

If editing the existing file, confirm these lines are in place in the VirtualHost block:

SSLCertificateFile /etc/ssl/certs/securitytest_site.crt
SSLCertificateKeyFile /etc/ssl/private/securitytest_site.key
SSLCertificateChainFile /etc/ssl/certs/My_CA_Bundle.ca-bundle

If you’re creating a new config file, ensure you include the following configuration block (replacing our placeholder securitytest.site-related values with your own): 

<VirtualHost *:443>  
ServerAdmin admin@securitytest.site  
ServerName securitytest.site  
DocumentRoot /var/www/html  
SSLEngine on  
SSLCertificateFile /etc/ssl/certs/securitytest_site.crt SSLCertificateKeyFile /etc/ssl/private/securitytest_site.key SSLCertificateChainFile /etc/ssl/certs/My_CA_Bundle.ca-bundle  

<Directory /var/www/html>  
Options Indexes FollowSymLinks  
AllowOverride All  
Require all granted  
</Directory>  

ErrorLog ${APACHE_LOG_DIR}/error.log  
CustomLog ${APACHE_LOG_DIR}/access.log  
combined  
</VirtualHost>Enable the site’s updated SSL configuration file and restart your Apache server to ensure it takes effect: 
sudo a2ensite default-ssl 
sudo systemctl reload apache2

Now, load the secure (HTTPS) version of your domain to verify that SSL/TLS is working. You should see a security padlock icon in Firefox and Edge and a “Connection is secure” message in Chrome.

Don’t want to do all of these manual steps? You don’t have to with GeoTrust Horizon’s AutoInstall SSL.

How to Install SSL Automatically on Debian (Apache2) 

Step 1: Get AutoInstall SSL 

Did you know that every SSL/TLS certificate purchased on GeoTrust.com includes automation? GeoTrust Horizon’s AutoInstall SSL agent enables 100% automated SSL/TLS certificate deployment, installation, and renewals on Linux and Windows servers.

Before you can use AutoInstall SSL, however, you must first specify that you want to use Automatic Installation during the certificate enrollment process.

Step 2: Specify Your Server to Install the AutoInstall SSL Agent  

This part of the wizard requires you to select Linux Server (Apache/NGINX) from the web server options list and complete the certificate validation process. (Note: This will require agreeing to the Subscriber Agreement terms and conditions. 

Step 3: Run the AutoInstall SSL Installer 

Use the following command to download and launch the installer: 

sudo wget -qO - https://files.autoinstallssl.com/packages/linux/version/latest/get.autoinstallssl.sh | sudo bash –s 

For the next step, you’ll need to grab the AutoInstall SSL token from GeoTrust Horizon. You’ll find the token info listed on the Manage Order — Enroll Now page in the AutoInstall section:  

Launch the agent using your token: 

sudo runautoinstallssl.sh installcertificate --token <your_token> --validationtype file --validationprovider filesystem 

Once this process is complete, the automation agent will handle the full certificate generation and installation process for you:  

• CSR generation,  
• Domain validation,  
• Certificate installation, 
• Apache2 configuration updates, and  
• Server reload. 

Step 4: Test to Ensure Everything Works as Intended 

Visit your domain over HTTPS in a browser to ensure your site loads without security issues and warnings. 

Use GeoTrust Horizon’s SSL Monitor to get alerts about any SSL/TLS certificate expirations and 110+ other SSL/TLS-related vulnerabilities. 

Why Automate SSL Setup? 

	Manual Certificate Installation	GeoTrust Horizon AutoInstall SSL
Time to Complete	20–30 minutes	2 minutes (for the initial setup — after that, renewals happen in the background automatically)
Error Risk	Moderate	Low
Renewals	Manual	Built in automation
Skill Required	Intermediate	Beginner friendly

Common Questions (for Debian Apache2 Users) 

Can I replace my existing SSL certificate with a new one? 

Yes. Simply upload the new certificate, key, and CA bundle, then edit your Apache config to point to the new files and reload Apache. It’s a good idea to do this one to two weeks before the certificate is set to expire. 

Is using the fullchain.pem file required for Apache2? 

Not necessarily — it depends on which version of Apache you’re using. If you’re using an older version of Apache (i.e., versions predating Apache 2.4.8) just use the .crt and .ca-bundle files. Apache2 reads them separately via the SSLCertificateFile and SSLCertificateChainFile commands.  

If you’re using Apache 2.4.8 or later, then using the fullchain.pem file is recommended. 

How do I test if my Apache2 SSL config is valid? 

Run the following command: 

sudo apachectl configtest 

You should see Syntax OK. If you see this, go ahead and reload your server: 

sudo systemctl reload apache2 

If you encounter errors (e.g., missing or incorrect file paths, invalid directives, etc.), Apache will typically show the line and file in question. To check your logs: 

sudo journalctl -xe 
sudo tail -f /var/log/apache2/error.log 

How do I renew an SSL certificate? 

Purchase or reissue a new certificate, then repeat the installation steps we covered earlier. AutoInstall SSL users don’t need to worry — renewals are handled automatically. 

What do I do if HTTPS still isn’t working? 

• Double-check paths in your Apache config 

• Ensure your certificate and chain are correctly formatted 

• Make sure the server time is accurate