Setting up Apache SSL con­fig­ures the popular web server to use HTTPS. HTTPS encrypts the con­nec­tion between the user’s browser and the web server. To set it up, manual steps may be taken on the server depending on the hosting en­vi­ron­ment. We show how to proceed in this process.

Re­quire­ments to use Apache SSL

To establish SSL-encrypted con­nec­tions with the Apache web server, a valid SSL cer­tifi­cate is required first. SSL cer­tifi­cates are usually provided free of charge via “Let’s Encrypt” and con­fig­ured au­to­mat­i­cal­ly in af­ford­able hosting plans. There are many other ways to obtain an SSL cer­tifi­cate, too. For pro­fes­sion­al ap­pli­ca­tions, it is worth­while setting up a specially issued SSL cer­tifi­cate. This signals to site visitors that they are actually com­mu­ni­cat­ing with the desired or­ga­ni­za­tion. This fosters ad­di­tion­al trust in your site.

Tip

Buy an SSL cer­tifi­cate from IONOS – it’ll provide af­ford­able en­cryp­tion for your website.

In essence, an SSL cer­tifi­cate is issued for a specific domain. This is a purely technical ver­i­fi­ca­tion criterion. Beyond that, more stringent val­i­da­tion levels exist, up to and including ver­i­fi­ca­tion of the or­ga­ni­za­tion­al identity by a human. Let’s take a look at the different val­i­da­tion levels at a glance:

Val­i­da­tion Ex­pla­na­tion Use
Domain Val­i­da­tion (DV) Ensures that com­mu­ni­ca­tion is encrypted and only with the specified domain. Doesn’t reveal who owns the domain. Leads to warning message in browser in case of phishing attempt or man-in-the-middle attack.
Or­ga­ni­za­tion Val­i­da­tion (OV) Like DV; ad­di­tion­al­ly checks that the domain belongs to the specified or­ga­ni­za­tion. Con­sid­ered a minimum re­quire­ment for online commerce.
Extended Val­i­da­tion (EV) Like OV; ad­di­tion­al human ver­i­fi­ca­tion of the or­ga­ni­za­tion’s identity. Used by large or­ga­ni­za­tions such as banks, as well as gov­ern­ment and official or­ga­ni­za­tions.

In addition to SSL cer­tifi­cates for in­di­vid­ual domains, there are wildcard cer­tifi­cates. These apply to all sub­do­mains below a specified domain. So, the cer­tifi­cate *.example.com is valid for the domains www.example.com, dev.example.com, store.example.com, blog.example.com etc. Wildcard cer­tifi­cates are practical for running a live and staging site and store or blog in parallel on one server.

If you already have a valid SSL cer­tifi­cate, you still need SSH access to the web server and “sudo” or “root” access to set up Apache SSL.

Tip

Learn to set up an Apache webserver yourself!

How to set up an Apache SSL cer­tifi­cate

The specific procedure for setting up Apache SSL depends on the operating system (OS) and Apache version used. Here’s the process for the “Apache httpd 2.4 default layout”. The Apache2 en­vi­ron­ment on Ubuntu requires a slightly different procedure. For more con­fig­u­ra­tions for common com­bi­na­tions of OS and Apache version, see the official Apache Wiki.

The general process when setting up Apache SSL manually includes the following steps:

  1. Generate cer­tifi­cate files
  2. Place cer­tifi­cate files on server
  3. Insert Apache SSL con­fig­u­ra­tion
  4. Test Apache SSL func­tion­al­i­ty

Let’s look at each step in detail.

Generate Apache SSL cer­tifi­cate files

To obtain the SSL cer­tifi­cate files, a “Cer­tifi­cate Signing Request” (CSR) is executed. The CSR process as­so­ciates the domain name with iden­ti­fy­ing char­ac­ter­is­tics of the or­ga­ni­za­tion and a cryp­to­graph­ic key. Depending on the cer­tifi­cate provider, the CSR is executed either via a web interface or from the command line. We’ll show an example of a cer­tifi­cate signing request via OpenSSL:

openssl req –new –newkey rsa:2048 –nodes –keyout <server-name>.key –out <server-name>.csr

When the command is executed, in­for­ma­tion is requested and a handful of files are created. Here’s an overview of the files created when the Cer­tifi­cate Signing Request (CSR) is executed, including file ex­ten­sions:

File Extension Ex­pla­na­tion
Private key .key Used to generate CSR and later secure and verify con­nec­tions using the cer­tifi­cate.
CSR file .csr Required to order the SSL cer­tifi­cate.
In­ter­me­di­ate SSL Cer­tifi­cate .crt Cer­tifi­cate that enables a cer­tifi­cate authority to issue ad­di­tion­al cer­tifi­cates.
Primary SSL cer­tifi­cate .crt SSL cer­tifi­cate issued for a specific domain and or­ga­ni­za­tion.

Place Apache SSL cer­tifi­cate files on server

To set up Apache SSL, the cer­tifi­cate files are placed on the server. Usually, there are two to three files:

  1. Private key
  2. Primary SSL cer­tifi­cate
  3. In­ter­me­di­ate SSL cer­tifi­cate, if ap­plic­a­ble

Put these files in their own folder and make sure they are readable by the root user only. From the command line, use the following steps:

Create folder for cer­tifi­cate files:

mkdir -p /root/cert/
  1. Move cer­tifi­cate files to folder:
mv /path/to/cert-files/* /root/cert/
  1. Customize users and per­mis­sions to make folders and files readable only by root:
chown root:root /root/cert/
chown root:root /root/cert/*
chmod 400 /root/cert/*
chmod 500 /root/cert/
Note

Pro­tect­ing the cer­tifi­cate folder is not the same process as setting password pro­tec­tion for a directory with Apache. Make sure you know the dif­fer­ence!

Insert Apache SSL con­fig­u­ra­tion

Once the cer­tifi­cate files are on the server, you can turn to the Apache SSL con­fig­u­ra­tion. The heart of the Apache SSL con­fig­u­ra­tion is a “Virtual Host” block (VHost block). In most cases, a VHost block already exists for HTTP con­nec­tions. If the server is to respond to both HTTPS and HTTP requests, both VHost blocks are required.

Edit Apache con­fig­u­ra­tion file:

nano /usr/local/apache2/conf/httpd.conf

Identify the existing VHost block for HTTP.

The block you are looking for for HTTP contains port number 80:

<VirtualHost *:80>
    DocumentRoot "/var/www/html"
    ServerName your.domain.example.com
</VirtualHost>

Duplicate HTTP VHost block and adjust for HTTPS.

Now duplicate the HTTP VHost block, adjust the port to 443, and add the Apache SSL-specific settings:

<VirtualHost *:443>
    DocumentRoot "/var/www/html"
    ServerName your.domain.example.com
        SSLEngine on
        SSLCertificateFile /path/to/your_domain_name.crt
        SSLCertificateKeyFile /path/to/your_private.key
        SSLCertificateChainFile /path/to/DigiCertCA.crt
</VirtualHost>

Sub­se­quent­ly, save the changes to the Apache con­fig­u­ra­tion file.

Test Apache SSL func­tion­al­i­ty

A lot can go wrong when setting up the Apache SSL con­fig­u­ra­tion. There are subtle dif­fer­ences in the settings depending on the de­ploy­ment scenario and re­quire­ments. It is therefore necessary to test the Apache SSL func­tion­al­i­ty. The handy command line tool 'a­pachectl' is available for this purpose:

apachectl configtest

If this command does not work, try the al­ter­na­tive command 'apache2ctl':

apache2ctl configtest

If the test was suc­cess­ful, restart the Apache server:

apachectl restart

After the Apache server restarts with cus­tomized con­fig­u­ra­tion, test the SSL con­nec­tion. To do this, open the site in at least two different browsers. Last but not least, put the installed cer­tifi­cate to the test. For this purpose, you can use the free SSL check from IONOS.

Go to Main Menu