How to Install & Configure an SSL Certificate on an Apache2 Web Server (Ubuntu)

Securing your website with HTTPS on Apache2 running Ubuntu is essential for protecting user data and improving your site’s SEO performance. This guide walks you through two proven ways to install an SSL certificate on Apache2: 

• The manual method using OpenSSL and a GeoTrust SSL/TLS certificate 

• The automated method using GeoTrust Horizon’s AutoInstall SSL agent 

Whether you’re configuring a new server or upgrading an existing one, follow this step-by-step guide to secure your site using the secure HTTPS protocol. 

Related: Looking for a guide on how to install an SSL certificate on NGINX Ubuntu? Look no further.

Prerequisite: You Must Have an SSL/TLS Certificate  

To enable SSL (or, more accurately, TLS) on your Apache Ubuntu server, you must have a valid SSL/TLS certificate installed on your server.

GeoTrust.com offers a selection of certificates for trusted encryption, compatibility, and flexible options to suit different needs. (You can purchase an SSL/TLS certificate easily through your GeoTrust Horizon platform user account dashboard.)

Manual Method: Installing an SSL Certificate on Apache (Ubuntu) 

This section will show you how to install and configure an SSL/TLS certificate manually on your Apache2 server running the Ubuntu distro.   

Step 1: Generate & Submit a Certificate Signing Request (CSR) 

Before you can install an SSL certificate on Apache, you’ll first need to generate a private key and use it to create a certificate signing request (CSR). The CSR, containing the corresponding public key, must then be sent to the issuing certification authority (CA).

To do this on your Apache Ubuntu server using OpenSSL, use a customized version of the following command: 

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr 

This will trigger a request for several key pieces of information that will become part of the certificate once it’s issued.  

The next step is to submit the CSR to the certificate provider. This is done for GeoTrust.com orders in the GeoTrust Horizon dashboard as part of the Certificate Enrollment process.

• Select All Orders > Generate Certificate.
• Specify your domain and hit the Continue button.
• Select Manual Installation and pres Continue again.
• Paste your CSR on the next screen and read and accept the subscriber terms and conditions agreement.

Ensure you include the full header (—–BEGIN CERTIFICATE—–) and footer (—–END CERTIFICATE—–) components of the CSR data: 

-----BEGIN CERTIFICATE-----
MIIEnFaTaOpelehyKmJyyL37GLVrTteQH4WOqVkoTzANBgkqhkiG9w0BAQsFADBg
MQswCQYDVQQpisiUoEKuPUPglbBI06fzD0OZWHfyXnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnBNH8sb4Fuwv3uFYW49FvO7s4AgLPnJdbBUTFMgUlNBIENBIEcx
MB4XDTI1MTIxAgfbKcfYvYrImneSLf78KESF6rsuVHQHHzEdMBsGA1UEAxMUdHJh
dmVsLml0c25QgIRdaczYRIoaebm9tKxQnJHbjUrqATEBAQUAA4IBDwAwggEKAoIB
AQDL34bbAv1pslBrvCwcs77nU6+8wOdj7ZkWh7IyoMWlfBlQ7JS4TL5oreSPSqhK
4YUqIWq91quAyXXULj9kxD5wV2UpUcBid4K2V2Q9M/8plWMv6JGaSgHeRJgxNo8j
THjWUFhZlmarKzmAqu8DQzBYKYYkgJRjMgihju8H4hmisZH4oRJAudyyeituFLIm
oLNCeGgJeOweS0NQjCSmSW93LiTqZYNZp+LJgNIMUB5EWhRmxz6dbYLPEAb8OLvX
Ky97cewGKMI4f7GHQEwDp+QFy2pNYGkiBE02d5S0ayKteEc7qTA/IK/nXEY5aotD
Q+h/VHAk+/4tgfnhHJNWwl3pAgMBAAGjggGRMIIBjTAfBgNVHSMEGDAWgBSUT9Rd
i+Sk4qaA/SDZKEtHzy4JUrSIVJZRkjtxwhDIVsymZRPq9uvlHPBFheSgoAT9K5Yw
HwYDVR0RBBgwFoIUdHJhdmVsLml0c2F0ZXN0LnNpdGUwPgYDVR0gBDcwNTAzBgZn
gQwBAgEwKTAnY4Af8z7vAZi9HQJRLGUtlVZQfQ8Zt0Y0aWdpY2VydC5jb20vQ1BT
MA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATA/BgNVHR8EODA2
MDSgMqAwhi5odIGt4GroDAz9CkKucFvd91YNEZoJowQRzW9UcnVzdFRMU1JTQUNB
RzEuY3Jsth3tGQwTfRnYKOa3RShP5r9tgSl3W4SPBQcwAYYaaHR0cDovL3N0YXR1
cy5nZW90cnVzdkVY1MM7adTSA8FafRNfU4HNhX4qhv7m8y9jYWNlcnRzLmdlb3Ry
dXN0LmNvbS9HZW9UcnVzdFRMU1JTQUNBRzEuY3J0sRZniP1liC4QakA8fRxyr3Me
A3F6fG3sNAQELBQADggEBADppn2GFQApnIcfQzKMLibPniAflTTltPere9RPquDU
D1TnuAcMLGpGwm3n39A4uCYipad/oQ7Ym3fqIVidImRkLfECLWm7/qjYGL33rnqr
Cnc1IZlOSSpLIwmEaRKi6XmulNQHnwOSyN03SuTcvT5ISd4GIFOvXD/A7mL4xn6Y
ko0KX4AqvB0SsPELfLk9jmqFxoHDZ18U7Ehzmb4xLvAbNY7+EJX+1nFXNQAUhtgh
K7wZsGVgmzlKMKAKiJwQmoW+z4JRnJKRY4Jl1dQsGRH+d5CBWbQ9p3q9Kj3rFqZx
6LdTB2ShiwZzSL+uvB4zP+OW2f6W0G71wZ0wTrmleBM=
-----END CERTIFICATE-----

That’s it! Now, it’s time to move on to the domain control validation (DCV) process. 

Step 2: Prove You Control the Domain in Question 

Complete domain validation using any of the methods listed below. We’ll use HTTP file-based validation for this example. (Note: This DCV method is recommended for all SSL/TLS certificates except for wildcards, which can’t use file-based validation.) 

The file-based validation method involves downloading a unique file from the certificate provider and uploading it to a specified file path on your server. This file contains your site’s hostname and a unique HTTP verification token value.  

For this example, we’ll download the .txt file (shown in step 1 of the screenshot below) from the GeoTrust Horizon dashboard and upload the file to the directory specified in step 2. Your Apache directory might look something like this: 

/var/www/html/.well-known/pki-validation/ 

Your server needs to be able to access the validation file publicly, which means setting the correct Linux permissions for both the directories and the file itself. 

• Use 755 on the directories to allow the server to read, write, and execute, and other groups read and execute permissions only: 

sudo chmod 755 /var/www/html/.well-known 

sudo chmod 755 /var/www/html/.well-known/pki-validation

• Use 644 on the file to allow the server to read and write on it while keeping it protected from changes by other users by only assigning them read permissions: 

sudo chmod 644 /var/www/html/.well-known/pki-validation/filename.txt 

Once you’ve uploaded the validation file and set the correct permissions, it’s time to verify that it’s publicly accessible. Open your browser and navigate to: 

https://yourdomain.com/.well-known/pki-validation/filename.txt 

If the file loads successfully and displays the correct validation content, return to the GeoTrust Horizon dashboard and click Request Verification. Wait a few minutes, then click Re-check Status to confirm that your domain has been validated. 

Note: If you have an organization validation (OV) or extended validation (EV) SSL/TLS certificate, there will be additional validation steps to complete before your certificate can be issued.

Step 3: Download and Install Your SSL Certificate Files 

Once your domain is validated (along with any other relevant organization information for higher-validation certificates), the CA issues the SSL certificate. You can download the .zip file for your certificate from the GeoTrust Horizon dashboard, as shown below: 

Next, you must unzip the file folder containing at least these two files: 

• yourdomain.crt (domain certificate) 

• your_ca_bundle.ca-bundle (intermediate CA) 

Upload the files to your server using the following command (just be sure to replace the generic placeholder data with your specific file- and domain-related information): 

scp -i your-access-key.pem your_domain.crt your_ca_bundle.ca-bundle user@your_ip:/home/user/ 

To move these files to secure directories, use the following commands (replacing the generic file names with your files’ unique values): 

sudo mv your_domain.crt your_ca_bundle.ca-bundle /etc/ssl/certs/ 

sudo mv your_domain.key /etc/ssl/private/ 

Note: Unlike NGINX, Apache does not require you to create a combined certificate chain file (fullchain.pem). Instead, you can directly reference the individual certificate and CA bundle files using the SSLCertificateFile and SSLCertificateChainFile directives. 

Set file permissions to ensure your SSL files are secure and readable by Apache: 

sudo chmod 644 /etc/ssl/certs/your_domain.crt 

sudo chmod 600 /etc/ssl/private/your_domain.key 

Step 4: Configure Apache2 to Use SSL 

Now that your SSL files are in place and permissioned correctly, it’s time to tell Apache to use them. This involves enabling SSL support and setting up a secure Virtual Host configuration for your website. 

First, enable Apache’s SSL module (this allows Apache to handle HTTPS requests): 

sudo a2enmod ssl

Next, you’ll create (or update) a Virtual Host file specifically for SSL traffic. This is where Apache will be instructed to load your certificate, key, and CA bundle files. Use the following command to open or create the configuration file: 

sudo nano /etc/apache2/sites-available/your_domain-ssl.conf 

Inside the file, paste the following configuration block — be sure to replace placeholder values with your actual domain and certificate file names. The following example provides an idea of what it would look like for the website securitytest.site with relevant example file names: 

<VirtualHost *:443> 

    ServerAdmin admin@securitytest.site 

    ServerName securitytest.site 

    DocumentRoot /var/www/html 

  

    SSLEngine on 

    SSLCertificateFile /etc/ssl/certs/securitytest_site.crt 

    SSLCertificateKeyFile /etc/ssl/private/securitytest_site.key 

    SSLCertificateChainFile /etc/ssl/certs/My_CA_Bundle.ca-bundle 

  

    <Directory /var/www/html> 

        Options Indexes FollowSymLinks 

        AllowOverride All 

        Require all granted 

    </Directory> 

  

    ErrorLog ${APACHE_LOG_DIR}/error.log 

    CustomLog ${APACHE_LOG_DIR}/access.log combined 

</VirtualHost> 

Once the block is configured, enable the site and restart Apache: 

sudo a2ensite securitytest_site-ssl.conf 

sudo systemctl reload apache2  

Now, test your website to see whether the changes have taken effect. If so, you should see the SSL/TLS certificate information and your site listed as being secure:

Automatic Method: Use AutoInstall SSL Agent (Apache2 Ubuntu) 

Don’t waste time trying to install and configure every SSL certificate on your Apache Ubuntu web server manually — there’s an automated solution that can do it for you. Meet GeoTrust Horizon’s AutoInstall SSL.

Step 1: Start the SSL Certificate Enrollment Process 

Log in to your GeoTrust Horizon account. In the dashboard, go to All Orders, find your certificate order, and select Generate Certificate. This will start the Certificate Enrollment process.

Specify the domain name the certificate will secure and hit Continue. Next, select Automatic Installation, as shown in the example screenshot below.

Step 2: Specify Your Server Type (Apache) 

Choose Linux Server (Apache/NGINX) and proceed with file-based or DNS validation (so long as you’ve not selected a wildcard SSL/TLS certificate because file-based validation isn’t an option for those certificates). 

Step 3: Install AutoInstall SSL and Your SSL Certificate on Your Apache2 Ubuntu Server 

How to Install AutoInstall SSL

SSH into your Ubuntu server and run the following command to download and launch the AutoInstall SSL installation script:

sudo wget -qO - https://files.autoinstallssl.com/packages/linux/version/latest/get.autoinstallssl.sh | sudo bash -s

Note: You must confirm the agent has been installed successfully before continuing. 

How to Install the SSL Certificate

This next step requires using your AutoInstall SSL token for the next command. This is included automatically in the SSL Certificate installation command provided in the GeoTrust Horizon dashboard. But if you need to collect it manually for some reason, the token can be found in the GeoTrust.com dashboard.

• Scroll to the Assets section, find the domain, and hit Manage.
• Scroll down to the SSL Certificates section, locate the certificate you want to use AutoInstall SSL to install, and select the eye-shaped icon. 
• On the next screen, scroll to the AutoInstall SSL section to find the token listed (as shown below): 

NOTE: Select the Agent Installation Instructions highlighted under the token above to launch the installation wizard. 

Once the script is ready, run the following command, which includes the AutoInstall SSL token, to begin the installation process. (Note: You must change out the generic YOUR_TOKEN_VALUE and replace it with your own.) 

sudo runautoinstallssl.sh installcertificate --token YOUR_TOKEN_VALUE --validationtype file --validationprovider filesystem 

Once completed, the GeoTrust Horizon AutoInstall SSL agent will be ready to use to automate the following for your SSL/TLS certificate in the future: 

• Generate your CSR 

• Complete the domain control validation process 

• Install SSL certificate(s) on your server 

• Update your Apache2 configuration 

Just press Enter when prompted to complete the process. 

Related: Learn additional AutoInstall SSL Agent Commands 

Step 4: Verify That the SSL/TLS Protocol Is Working on Your Apache Site 

Once the installation is complete, open your browser and visit the https:// version of your domain (e.g., https://yourdomain.com). Make sure the site loads without any security warnings and displays the secure padlock icon — this confirms that your SSL certificate is active and properly configured to enable a secure, encrypted connection. 

Pro Tip: A Few Final Housekeeping Items

Even though your SSL/TLS certificate is now active and your site is secure, your job isn’t done. There are a few additional steps you should take to keep your website secure and ensure your certificates always remain current.

• Test Your SSL Configuration: Use an SSL online scan tool to analyze your server’s SSL setup, grade its security, and identify any vulnerabilities. GeoTrust Horizon’s SSL Monitor is one such feature that enables you to identify 110+ SSL and server-related vulnerabilities.  

• Enable Auto-Renewal via AutoInstall SSL: GeoTrust Horizon’s AutoInstall SSL agent supports automated certificate renewals. Learn how to configure this feature and make SSL/TLS certificate expiration-related downtime a thing of the past.

Why Choose Automatic Installation Over Manual Methods? 

1. Be Prepared for Shorter Certificate Lifespans in the Future  

While most publicly trusted SSL/TLS certificates still have a maximum validity of 398 days, browser vendors and CAs have announced plans to gradually reduce this to just 47 days by 2029.

Automating installation and renewal now helps you future-proof your site against the upcoming shift — reducing the risk of missed renewals, downtime, or browser warnings. 

2. Save Time and Reduce Manual Effort 

AutoInstall SSL handles everything from CSR generation to Apache2 configurations within minutes. 

3. Eliminate the Human Error Factor in Config File Updates 

No typos, permission issues, or misconfigured virtual hosts. 

4. Eliminate Time-Consuming Certificate Installation Tasks with Auto-Renewals 

Never worry about manually renewing your SSL/TLS certificates again — let the AutoInstall SSL agent handle it for you. 

5. Great for Beginners and Pros Alike 

One command is all it takes. No Apache knowledge is required. 

Additional Tips 

• Use GeoTrust Horizon’s SSL Monitor to monitor your site for certificate expiration and 110+ SSL/TLS vulnerabilities 

• Keep Apache2 and OpenSSL updated 

Common Questions 

Can I replace an existing Apache2 certificate with a new one? 

Yes — upload the new .crt, .key, and .ca-bundle files to your server, update the paths in your Apache virtual host file, and reload Apache2 to apply the changes. For a smooth transition, it’s best to do this at least 7–10 days before your current certificate expires, giving you time to verify everything is working correctly and avoid potential downtime. 

Do I need to restart Apache2 after renewal? 

Yes. Run sudo systemctl reload apache2 to apply changes. 

Is fullchain.pem required for Apache2? 

No. Apache2 uses the SSLCertificateChainFile with separate .crt and .ca-bundle files. 

How can I test Apache2 SSL config? 

To verify that your Apache SSL configuration is correct and error-free, run: 

sudo apache2ctl configtest

If you receive the response Syntax OK, then restart Apache: 

sudo systemctl reload apache2

What if you don’t see “Syntax OK”? 

If there’s a syntax error, the output will tell you which line or file has an issue. Common issues include: 

• Incorrect file paths for your SSL certificate or key 

• Missing or extra characters in the <VirtualHost> block 

• Invalid directives or typos 

Review the indicated line in your config file, correct the issue, and run the test again. You can also check Apache’s error logs for more details: 

sudo tail -n 50 /var/log/apache2/error.log

Does AutoInstall SSL work with Apache2? 

Yes — the agent detects your Apache server and configures it accordingly. 

Can I automate Apache2 SSL certificate renewals with AutoInstall SSL? 

Yes. AutoInstall SSL supports renewals and reconfiguration automatically.