Setting up Apache SSL con­fig­ures the popular web server to use HTTPS. HTTPS encrypts the con­nec­tion between the user’s browser and the web server. To set it up, manual steps may be taken on the server depending on the hosting en­vir­on­ment. We show how to proceed in this process.

Re­quire­ments to use Apache SSL

To establish SSL-encrypted con­nec­tions with the Apache web server, a valid SSL cer­ti­fic­ate is required first. SSL cer­ti­fic­ates are usually provided free of charge via ‘Let’s Encrypt’ and con­figured auto­mat­ic­ally in af­ford­able hosting plans. There are many other ways to obtain an SSL cer­ti­fic­ate, too. For pro­fes­sion­al ap­plic­a­tions, it is worth­while setting up a specially issued SSL cer­ti­fic­ate. This signals to site visitors that they are actually com­mu­nic­at­ing with the desired or­gan­isa­tion. This fosters ad­di­tion­al trust in your site.

Tip

Buy an SSL cer­ti­fic­ate from IONOS – it’ll provide af­ford­able en­cryp­tion for your website.

In essence, an SSL cer­ti­fic­ate is issued for a specific domain. This is a purely technical veri­fic­a­tion criterion. Beyond that, more stringent val­id­a­tion levels exist, up to and including veri­fic­a­tion of the or­gan­isa­tion­al identity by a human. Let’s take a look at the different val­id­a­tion levels at a glance:

Val­id­a­tion Ex­plan­a­tion Use
Domain Val­id­a­tion (DV) Ensures that com­mu­nic­a­tion is encrypted and only with the specified domain. Doesn’t reveal who owns the domain. Leads to warning message in browser in case of phishing attempt or man-in-the-middle attack.
Or­gan­isa­tion Val­id­a­tion (OV) Like DV; ad­di­tion­ally checks that the domain belongs to the specified or­gan­isa­tion. Con­sidered a minimum re­quire­ment for online commerce.
Extended Val­id­a­tion (EV) Like OV; ad­di­tion­al human veri­fic­a­tion of the or­gan­isa­tion’s identity. Used by large or­gan­isa­tions such as banks, as well as gov­ern­ment and official or­gan­isa­tions.

In addition to SSL cer­ti­fic­ates for in­di­vidu­al domains, there are wildcard cer­ti­fic­ates. These apply to all sub­do­mains below a specified domain. So, the cer­ti­fic­ate *.example.com is valid for the domains www.example.com, dev.example.com, store.example.com, blog.example.com etc. Wildcard cer­ti­fic­ates are practical for running a live and staging site and store or blog in parallel on one server.

If you already have a valid SSL cer­ti­fic­ate, you still need SSH access to the web server and ‘sudo’ or ‘root’ access to set up Apache SSL.

Tip

Learn to set up an Apache webserver yourself!

How to set up an Apache SSL cer­ti­fic­ate

The specific procedure for setting up Apache SSL depends on the operating system (OS) and Apache version used. Here’s the process for the ‘Apache httpd 2.4 default layout’. The Apache2 en­vir­on­ment on Ubuntu requires a slightly different procedure. For more con­fig­ur­a­tions for common com­bin­a­tions of OS and Apache version, see the official Apache Wiki.

The general process when setting up Apache SSL manually includes the following steps:

  1. Generate cer­ti­fic­ate files
  2. Place cer­ti­fic­ate files on server
  3. Insert Apache SSL con­fig­ur­a­tion
  4. Test Apache SSL func­tion­al­ity

Let’s look at each step in detail.

Generate Apache SSL cer­ti­fic­ate files

To obtain the SSL cer­ti­fic­ate files, a ‘Cer­ti­fic­ate Signing Request’ (CSR) is executed. The CSR process as­so­ci­ates the domain name with identi­fy­ing char­ac­ter­ist­ics of the or­gan­isa­tion and a cryp­to­graph­ic key. Depending on the cer­ti­fic­ate provider, the CSR is executed either via a web interface or from the command line. We’ll show an example of a cer­ti­fic­ate signing request via OpenSSL:

openssl req –new –newkey rsa:2048 –nodes –keyout <server-name>.key –out <server-name>.csr

When the command is executed, in­form­a­tion is requested and a handful of files are created. Here’s an overview of the files created when the Cer­ti­fic­ate Signing Request (CSR) is executed, including file ex­ten­sions:

File Extension Ex­plan­a­tion
Private key .key Used to generate CSR and later secure and verify con­nec­tions using the cer­ti­fic­ate.
CSR file .csr Required to order the SSL cer­ti­fic­ate.
In­ter­me­di­ate SSL Cer­ti­fic­ate .crt Cer­ti­fic­ate that enables a cer­ti­fic­ate authority to issue ad­di­tion­al cer­ti­fic­ates.
Primary SSL cer­ti­fic­ate .crt SSL cer­ti­fic­ate issued for a specific domain and or­gan­isa­tion.

Place Apache SSL cer­ti­fic­ate files on server

To set up Apache SSL, the cer­ti­fic­ate files are placed on the server. Usually, there are two to three files:

  1. Private key
  2. Primary SSL cer­ti­fic­ate
  3. In­ter­me­di­ate SSL cer­ti­fic­ate, if ap­plic­able

Put these files in their own folder and make sure they are readable by the root user only. From the command line, use the following steps:

Create folder for cer­ti­fic­ate files:

mkdir -p /root/cert/
  1. Move cer­ti­fic­ate files to folder:
mv /path/to/cert-files/* /root/cert/
  1. Customise users and per­mis­sions to make folders and files readable only by root:
chown root:root /root/cert/
chown root:root /root/cert/*
chmod 400 /root/cert/*
chmod 500 /root/cert/
Note

Pro­tect­ing the cer­ti­fic­ate folder is not the same process as setting password pro­tec­tion for a directory with Apache. Make sure you know the dif­fer­ence!

Insert Apache SSL con­fig­ur­a­tion

Once the cer­ti­fic­ate files are on the server, you can turn to the Apache SSL con­fig­ur­a­tion. The heart of the Apache SSL con­fig­ur­a­tion is a ‘Virtual Host’ block (VHost block). In most cases, a VHost block already exists for HTTP con­nec­tions. If the server is to respond to both HTTPS and HTTP requests, both VHost blocks are required.

Edit Apache con­fig­ur­a­tion file:

nano /usr/local/apache2/conf/httpd.conf

Identify the existing VHost block for HTTP.

The block you are looking for for HTTP contains port number 80:

<VirtualHost *:80>
    DocumentRoot ‘/var/www/html’
    ServerName your.domain.example.com
</VirtualHost>

Duplicate HTTP VHost block and adjust for HTTPS.

Now duplicate the HTTP VHost block, adjust the port to 443, and add the Apache SSL-specific settings:

<VirtualHost *:443>
    DocumentRoot ‘/var/www/html’
    ServerName your.domain.example.com
        SSLEngine on
        SSLCertificateFile /path/to/your_domain_name.crt
        SSLCertificateKeyFile /path/to/your_private.key
        SSLCertificateChainFile /path/to/DigiCertCA.crt
</VirtualHost>

Sub­sequently, save the changes to the Apache con­fig­ur­a­tion file.

Test Apache SSL func­tion­al­ity

A lot can go wrong when setting up the Apache SSL con­fig­ur­a­tion. There are subtle dif­fer­ences in the settings depending on the de­ploy­ment scenario and re­quire­ments. It is therefore necessary to test the Apache SSL func­tion­al­ity. The handy command line tool 'a­pachectl' is available for this purpose:

apachectl configtest

If this command does not work, try the al­tern­at­ive command 'apache2ctl':

apache2ctl configtest

If the test was suc­cess­ful, restart the Apache server:

apachectl restart

After the Apache server restarts with cus­tom­ised con­fig­ur­a­tion, test the SSL con­nec­tion. To do this, open the site in at least two different browsers. Last but not least, put the installed cer­ti­fic­ate to the test. For this purpose, you can use the free SSL check from IONOS.

Go to Main Menu