This guide explains how to manually install an existing SSL certificate on an Apache web server running on a Linux server without a control panel, such as our KVM VPS servers. The steps work on Debian and Ubuntu, as well as on AlmaLinux, Rocky Linux and other Red Hat-based systems; where the two differ, we provide both versions.

Manual configuration is not always necessary:

• On cPanel hosting plans and web hosting accounts, the certificate is installed by the control panel (automatically in the case of Let’s Encrypt); you do not need to make any changes to the web server settings.
• If you would like a free Let’s Encrypt certificate for your own server, Certbot will handle the certificate request, Apache configuration and renewal.

Manual installation is required if you have purchased a paid certificate or obtained the certificate from another source, and you need to upload the files to the server yourself. Our blog post on installing SSL certificates provides general information on certificate types, generating a CSR and installation via cPanel.

What you’ll need

• Root or sudo privileges on the server.
• Apache is now up and running, and the domain is accessible via HTTP (the domain’s A record points to the server’s IP address). If it is not yet installed, see: Installing Apache and PHP-FPM on AlmaLinux 9.
• Port 443 is open on the firewall (see: How do I set up a firewall on my VPS?).
• Three files in PEM (text) format:
  • the domain’s certificate (e.g. pelda.hu.crt), which you received from the certificate authority;
  • the intermediate certificate or CA bundle (for example, ca-bundle.crt) that accompanies the certificate;
  • The private key (for example, pelda.hu.key), which was generated together with the CSR. The certificate authority does not send this, as it never received it: it is stored where the CSR was generated (see: Generating a CSR and private key).

If you have received the certificate in PFX or P7B format, first convert it to PEM format as described in the article on certificate formats. When opened in a text editor, a PEM file begins with the line -----BEGIN CERTIFICATE----- (and, for the key, -----BEGIN PRIVATE KEY-----).

The examples use the domain pelda.hu; please adapt the commands and settings to your own domain.

1. Enabling the SSL module

Debian, Ubuntu: the SSL module (mod_ssl) is part of the apache2 package; it does not need to be installed separately, it just needs to be enabled:

sudo a2enmod ssl

AlmaLinux, Rocky Linux, CloudLinux: the module is available as a separate package:

sudo dnf install -y mod_ssl

The package creates the file /etc/httpd/conf.d/ssl.conf, containing a default HTTPS virtual host that uses a self-signed certificate not accepted by browsers. Leave this file as it is (it also contains the module’s general settings); a separate file for your domain will be created in step 3.

2. File placement

Combine the domain certificate and the intermediate certificate into a single file. The order is important: the domain certificate first, followed by the intermediate certificate:

cat pelda.hu.crt ca-bundle.crt > pelda.hu-fullchain.crt

Next, copy the files to their usual location on the system and set the permissions. Only root can read the private key; Apache reads the key whilst running as root at start-up.

Debian, Ubuntu:

sudo cp pelda.hu-fullchain.crt /etc/ssl/certs/
sudo cp pelda.hu.key /etc/ssl/private/
sudo chown root:root /etc/ssl/private/pelda.hu.key
sudo chmod 600 /etc/ssl/private/pelda.hu.key

AlmaLinux, Rocky Linux, CloudLinux:

sudo cp pelda.hu-fullchain.crt /etc/pki/tls/certs/
sudo cp pelda.hu.key /etc/pki/tls/private/
sudo chown root:root /etc/pki/tls/private/pelda.hu.key
sudo chmod 600 /etc/pki/tls/private/pelda.hu.key
sudo restorecon -Rv /etc/pki/tls

The last command restores the SELinux labels on the files. If you move the files using the mv command instead of cp (for example, from your home directory), their old labels will remain, and Apache will be unable to open them due to SELinux, even if the permissions are correct.

Do not place your private key in your website directory (for example, under /var/www) and do not send it by email. If it does fall into the wrong hands, the article on leaked private keys explains what to do.

3. Configuring the HTTPS virtual host

Create a new configuration file for the domain.

Debian, Ubuntu: /etc/apache2/sites-available/pelda.hu-ssl.conf

AlmaLinux, Rocky Linux, CloudLinux: /etc/httpd/conf.d/pelda.hu-ssl.conf

The contents (please specify the file paths according to your system):

<VirtualHost *:443>
    ServerName pelda.hu
    ServerAlias www.pelda.hu
    DocumentRoot /var/www/pelda.hu

    SSLEngine on
    SSLCertificateFile    /etc/ssl/certs/pelda.hu-fullchain.crt
    SSLCertificateKeyFile /etc/ssl/private/pelda.hu.key

    ErrorLog  /var/log/apache2/pelda.hu-ssl-error.log
    CustomLog /var/log/apache2/pelda.hu-ssl-access.log combined
</VirtualHost>

On a Red Hat-based system, the certificate is located at /etc/pki/tls/certs/pelda.hu-fullchain.crt, the key at /etc/pki/tls/private/pelda.hu.key, and the logs at /var/log/httpd/...

The DocumentRoot must be the same as in the HTTP (port 80) virtual host, and if there are any additional settings there (<Directory> block, PHP-FPM handler), you must copy those over here as well; otherwise, the website will function differently over HTTPS.

Older documentation also includes a third line, SSLCertificateChainFile, which allowed the intermediate certificate to be specified in a separate file. Apache has considered this obsolete since version 2.4.8; today, all supported Linux distributions come with a newer version of Apache, so it is sufficient for the intermediate certificate to appear in the SSLCertificateFile file, after the domain certificate. The article on intermediate certificates explains why the site does not work on certain devices if the intermediate certificate is missing.

Debian, Ubuntu: enable the new page:

sudo a2ensite pelda.hu-ssl

On Red Hat-based systems, Apache automatically loads the .conf files located in the conf.d directory.

Secure protocols only

SSL 3.0, TLS 1.0 and TLS 1.1 are obsolete and vulnerable (see: What is the difference between TLS and SSL?). By default, most modern distributions no longer allow these, but it is advisable to explicitly enable only TLS 1.2 and TLS 1.3. On Debian and Ubuntu, look for the SSLProtocol line in the /etc/apache2/mods-available/ssl.conf file; on Red Hat-based systems, look for it in the /etc/httpd/conf.d/ssl.conf file (if it is commented out with a #, remove the symbol; if there is no such line, add it), and rewrite it as follows:

SSLProtocol -all +TLSv1.2 +TLSv1.3

On AlmaLinux and Rocky Linux, encryption settings are also governed by the system-wide cryptographic policy (update-crypto-policies), whose DEFAULT setting now only permits TLS 1.2 and later. For detailed configuration of encryption algorithms, the Mozilla SSL Configuration Generator tool provides an up-to-date template tailored to your specific versions of Apache and OpenSSL.

4. Checking and restarting

Before reloading Apache, check the syntax of the settings:

sudo apachectl configtest

If the response is Syntax OK, restart the web server:

sudo systemctl reload apache2   # Debian, Ubuntu
sudo systemctl reload httpd     # AlmaLinux, Rocky Linux, CloudLinux

When activating the module for the first time, you must restart rather than reload. If Apache fails to start, the cause of the error can be identified using the command sudo journalctl -u apache2 -n 50 (or -u httpd on Red Hat-based systems) or by checking the error log.

5. Redirecting from HTTP to HTTPS

Once the certificate has been installed, the website will also be accessible via HTTPS, but the http:// address will continue to work. You can redirect visitors and search engines to HTTPS using a permanent (301) redirect in the virtual host on port 80. Replace the content of the HTTP virtual host with the following:

<VirtualHost *:80>
    ServerName pelda.hu
    ServerAlias www.pelda.hu
    Redirect permanent / https://pelda.hu/
</VirtualHost>

If you would prefer to set up the redirect in an .htaccess file, or if you would like to know what steps to take following the switch (internal links, mixed content, Google Search Console), see: How can I redirect my website to HTTPS? If everything is working correctly, you can also use the HSTS header to instruct browsers to open the page via HTTPS only.

6. Checking the installation

Open the page in your browser at https:// and check whether there is a warning in the address bar. However, this alone is not enough: whilst browsers often automatically fill in the missing intermediate certificate, other programs and older mobile phones do not.

Our free SSL checker is more reliable: it shows whether the certificate is valid, which domain names it covers, when it expires, and whether the certificate chain is complete. Enter the addresses pelda.hu, www.pelda.hu at the same time, so you can check both versions in a single step.

You can use OpenSSL from the command line to view the certificate chain sent by the server:

openssl s_client -connect pelda.hu:443 -servername pelda.hu -showcerts </dev/null

At the start of the output, under Certificate chain, there must be at least two certificates listed (the domain certificate and the intermediate certificate), and at the end, the line Verify return code: 0 (ok) must appear.

Common errors

Apache fails to start, and the log shows error AH02565 or a ‘key values mismatch’ error. The certificate and private key do not match, for example because the certificate was requested using a different, later-generated CSR. You can check whether they match by comparing their public keys; the two commands should display the same value:

openssl x509 -in pelda.hu-fullchain.crt -noout -pubkey | openssl sha256
openssl pkey -in pelda.hu.key -pubout | openssl sha256

If they differ, locate the key associated with the certificate, or generate a new key and CSR, and have the certificate reissued. For certificates purchased from aWh, you can do this via the client portal (see: Setting up and reissuing a paid SSL certificate).

Apache asks for a password on start-up, or the systemctl command is unable to start it. The private key is password-protected. On the server, it is standard practice to store the key without a password (protection is provided by the 600 permissions); you can remove the password as follows:

sudo openssl pkey -in pelda.hu.key -out pelda.hu-nopass.key
sudo chmod 600 pelda.hu-nopass.key

The command prompts you for the key password and writes the key to the new file without a password. You should then specify this file in the SSLCertificateKeyFile line and delete the old one.

The site displays a certificate error on certain devices, programs or mobile phones, but works fine in the browser. The intermediate certificate is missing: please check that the file specified by SSLCertificateFile contains the intermediate certificate as well as the domain certificate.

The browser does not recognise the certificate as being issued for the domain, or displays a self-signed certificate. Apache is using a different virtual host for the request. Check that the ServerName and ServerAlias match the address you are trying to access exactly (including the www version), and use the command sudo apachectl -S to see which files contain which virtual hosts on port 443. The meanings of browser error messages are listed in the article on the ‘Your connection is not private’ error.

apachectl configtest returns the error “Invalid command ‘SSLEngine’”. The SSL module is not enabled or installed: run the command in Step 1.

The browser cannot connect via HTTPS (timeout or ‘connection refused’), but the page works via HTTP. The firewall is blocking port 443. On AlmaLinux and Rocky Linux, the sudo firewall-cmd --list-services command should list the https service; on Ubuntu, when using the ufw firewall, the sudo ufw status command shows the open ports.

Certificate renewal

Paid certificates are valid for a maximum of 200 days, so during a one-year subscription, the certificate must be reissued at least once (see: Why are SSL certificates no longer valid for a full year?). In this case, follow step 2 to replace the certificate file and restart Apache; you do not need to change the virtual host settings if you keep the same filename. If you have also generated a new private key, replace that as well.

You can avoid having to renew the certificate manually if you use a paid certificate with an ACME subscription: Certbot renews it automatically in the same way as Let’s Encrypt certificates (see the end of the article on Certbot). You can track the expiry date by following the instructions in the article on checking certificate expiry dates.

If you get stuck during setup, please contact us with your domain name and the error message.