Rocky Linux: How to Install an SSL Certificate

In the words of the immortal Rocky Balboa: “The world ain’t all sunshine and rainbows.” Cybercriminals are wreaking havoc on websites, and site owners are continuously trying to dodge their punches.

If you use Rocky Linux and want to add a layer of security to your website, then it’s time to install an SSL/TLS certificate. Through public key cryptography, you can protect your server’s sensitive data transmissions from prying eyes and prevent tampering. It also has the added benefit of improving your search engine rankings, fostering customers’ trust, and removing the pesky “not secure” browser warnings.

Which brings us to the all-important question: how do you install an SSL certificate on a Rocky Linux web server? You can do it manually or opt for the easy way (using automation).

Prerequisite: You First Have to Get Your Rocky Linux CA Certificates

If you already have a valid secure sockets layer/transport layer security (SSL/TLS) certificate issued by a renowned certificate authority (CA), you can skip this section. But if you don’t:

• Purchase an SSL/TLS certificate from a reputable CA (e.g., GeoTrust.com).
• Generate your certificate signing request (CSR) and private key.
• Submit your certificate and public key to the CA.

GeoTrust Horizon users can order them fast and hassle-free through their account dashboard.

Rocky Linux: How to Manually Install an SSL/TLS Certificate

Once you have your SSL/TLS certificate, you can start securing your Rocky Linux server following our step-by-step instructions. If your server uses a different Linux distro, such as AlmaLinux or the deprecated CentOS, then don’t worry. These directions work virtually the same across all Red Hat Enterprise Linux (RHEL) distributions!

In this example, we’ll assume that:

• Your Rocky Linux runs on Apache.
• You have admin access to the server.
• You’ve already uploaded your certificates and private key from your local system to your Rocky Linux server.

Important: When you follow our instructions and copy a command, make sure you replace the generic values with your information (e.g., file and folder paths, certificates, and key names).

1. Save Your Key, Certificate Files, and CA Bundle to a Secure Directory

Access Your Server via SSH to Move Your Certificate and Key Files

One by one, run the following scripts to move the private key, certificates, and CA bundle to a secure system directory of your choice (e.g., using the file paths /etc/httpd/ssl/, /etc/pki/tls/certs/, and /etc/pki/tls/private/ [for private keys]). Click Enter after each script. You can do this using the copy command (cp).

Reminder: Swap out the placeholder path and file name values in the example code snippets that follow throughout this article with your custom values.

cp /old_directory/your_new_directory/your_ssl.key.

cp /old_directory/your_new_directory/your_ssl.crt

cp /old directory/your_new_directory/your_CA_bundle.ca-bundle

Set the Correct Access Permissions

Set the .crt (i.e., 644) and .key files’ permissions to 644 and 600, respectively. This way, you’ll be the only one allowed to write your .crt files and access your private key.

sudo chmod 644 /your_new_directory/*.crt

sudo chmod 600 /your_new_directory/*.key

2. Create the Fullchain File

Combine your CA bundle with your SSL/TLS certificate (again, be sure to replace the file path and file name values with your own):

sudo bash -c 'cat /your_new_directory/your_ssl.crt /your_new_directory/your_CA_bundle.ca-bundle > /your_new_directory/your_fullchain.pem'

3. Open Your Configuration File in Edit Mode

In your terminal, type:

sudo nano /etc/httpd/conf.d/your_config-file.conf 

Tip: Do you prefer to edit your file with vim? That’s fine, too. Use the same script above and replace nano with vim. Don’t forget to press the letter i to insert the text.

4. Add a Permanent Redirection to Port 443

Now that you’re in edit mode, let’s ensure all of the communications between your Rocky Linux server and the client go through port 443, which uses the secure TLS protocol. Start by sending all requests to port 443 by adding a permanent redirection:

<VirtualHost *:80>
        ServerName www.yourdomain.com
        ServerAdmin username@rockylinux.org
        Redirect permanent / https://yourdomain.tld/
</VirtualHost>

Copy and paste the lines included in the example above and replace the generic values with your server’s details (i.e., the hostname and your domain information). This will tell all search engines [and any traffic coming from them] to direct any traffic straight to port 443.

5. Add the SSL Certificate Information

Copy and paste the configuration shown below to replace it beneath the VirtualHost*:80  section you’ve amended in step 4.

If you already have a <VirtualHost *:443> block, update it to include at least the information below. Just as before, be sure to replace the generic values with your custom details.

<VirtualHost *:443>
        ServerName www.yourdomain.com
        ServerAdmin username@rockylinux.org
        DocumentRoot /var/www/your_site_name/html
        DirectoryIndex index.php index.htm index.html
      
    CustomLog "/var/log/httpd/your_site_name.access_log" combined
    ErrorLog  "/var/log/httpd/your_site_name.error_log"

        SSLEngine on
        SSLProtocol all -SSLv2 -SSLv3 -TLSv1
              
        SSLCertificateFile /your_new_directory/your_fullchain.pem
        SSLCertificateKeyFile /your_new_directory/your_ssl.key
</VirtualHost>

Note: We didn’t specify the encryption and ciphers sections (i.e., SSLHonorCipherOrder on and SSLCipherSuite) to roll with the server’s default configuration. This way, every time the admin runs dnf upgrade to update the server, the cipher suites are also automatically updated. This avoids using deprecated or dangerous cipher suites in the configuration. However, if you want to be absolutely certain that you’re using the most current and secure SSL/TLS algorithms and configurations, use GeoTrust Horizon’s SSL Monitor.

Press Ctrl + O to save your file.

Tip: Did you use vim to edit your file instead of nano? To save the changes, hit Esc and type :w, followed by the Enter key.

6. Test Your New Configuration

Copy and paste the command below to test the updated configuration file. You should get a Syntax OK message.

apachectl configtest

7. Restart Httpd and Enable the Service at Startup

Apply the changes by restarting the system. You can do this using the following command and by pressing Enter:

sudo systemctl restart httpd

Next, ensure the service starts at boot by typing the command below and pressing Enter again:

sudo systemctl enable httpd

Ta-da! Your Rocky Linux installation of an SSL/TLS certificate is completed. Test to ensure it is properly installed and enabled by visiting the https:// version of your website.

Do you see the padlock (for Firefox users) or the “Connection is secure” message in Chrome, Edge, and Brave? If you do, it means your Rocky Linux installation with a CA-issued SSL/TLS certificate worked perfectly.

Rocky Linux: How to Install an SSL/TLS Certificate the Easy Way (Using Automation)

If you’re a GeoTrust Horizon customer or you’re looking for a faster and error-free installation, you can set up your SSL/TLS certificate once and then forget about it. Here’s how installing an SSL certificate works using GeoTrust Horizon’s AutoInstall SSL client.

1. Select the SSL/TLS Certificate

Log in to access your GeoTrust account. In the dashboard, click All Orders to view the list of all certificates you’ve purchased as a GeoTrust Horizon customer.

Hit the eye icon next to the SSL/TLS certificate you wish to install.

2. Set Up Your Automatic Installation Preferences

Select the Complete Certificate Enrollment button.

Tick Automatic Installation and hit the Continue button below this selection screen (not pictrured).

Click on Apache and pick your preferred certificate validation method. In this example, we’ve chosen the easiest process, file-based validation. 

3. Download and Install the AutoInstall Package

Connect to your web server as an administrator via Remote Desktop Protocol (RDP) or Secure Shell (SSH). Copy and paste the following command into a terminal and hit Enter:

sudo wget -qO - https://files.autoinstallssl.com/packages/linux/version/latest/get.autoinstallssl.sh | sudo bash -s

Alternatively, copy the command directly from the installation page.

4. Automatically Install and Configure Your SSL/TLS Certificate Via AutoInstall SSL

In your terminal window, copy and paste the script below, press Enter, and, at the prompt, type Y to continue with the installation process. GeoTrust AutoInstall SSL will take care of the rest of the process.

sudo runautoinstallssl.sh installcertificate --token your.unique.token.information –your.validation.type file.txt --validationprovider filesystem

Don’t forget to replace the geric values with your unique information:

• Your AutoInstall SSL token (located beneath the Complete Enrollment page, in the AutoInstall SSL section shown in the screenshot below)
• The CA’s validation file, which you can get from your GeoTrust Horizon dashboard.  

Done and dusted. That was easy-peasy and fast, wasn’t it? And you didn’t even have to restart your server!

5. Verify Your SSL/TLS Certificate Installation

Now, let’s see if it worked. Open your website with your favorite browser. Click near the URL to verify if the connection is secure, like in our example.

Not all your web servers are based on RHEL distros? Check out our SSL/TLS certificate installation tutorials for other common web server platforms:

• How to Install an SSL Certificate on Windows Server 2019
• The Must-Have Guide to NGINX SSL Configuration
• How to Install an SSL Certificate in CertPanel

Final Words About Rocky Linux: How to Install an SSL Certificate

There you have it. That’s how you secure your Rocky Linux server by installing an SSL/TLS certificate. Whether you run a small business or a large enterprise, the SSL/TLS certificates will reassure your customers that their data is safe while protecting your organization from data breaches.

Don’t forget, though! As with all digital certificates, Rocky Linux CA-issued certificates expire, too. Use GeoTrust Horizon’s AutoInstall SSL to ensure your certificates are renewed automatically when the time comes and avoid the headaches of costly certificate outages.