First, confirm that the prerequisites have been met, and then install the SSL certificate as follows: 1. Copy the domain name certificate, private key and intermediate certificate to the /etc/ssl/certs/ and /etc/ssl/private/ directory respectively and set the private key permission to 600; 2. Run sudo a2enmod ssl on Debian/Ubuntu and restart Apache, install mod_ssl on CentOS/RHEL and restart the service; 3. Edit the Apache virtual host configuration file, add VirtualHost blocks containing SSLEngine on, SSLCertificateFile, SSLCertificateKeyFile and SSLCertificateChainFile, or merge the certificate files with a single path; 4. Run sudo apachectl configtest verify the configuration, and restart the Apache service after displaying Syntax OK; 5. Optional but recommended to configure HTTP to HTTPS redirection, which is implemented through VirtualHost or .htaccess; 6. Finally, check the lock icon in the browser, and use SSL Labs or SSLChecker tools to verify the installation integrity to ensure the correct certificate chain, validity period and security settings. After the entire process is completed, Apache will provide services securely through HTTPS.

Installing an SSL certificate on Apache (typically Apache HTTP Server, also known as httpd) is essential for securing your website with HTTPS. Below is a step-by-step guide to help you install an SSL certificate on Apache. This guide assumes you're using a Linux-based system (like Ubuntu, CentOS, or Debian) and already have Apache installed.

? Prerequisites

Before starting:

• You must own a domain name.
• Apache must be installed and running.
• OpenSSL must be installed ( sudo apt install openssl on Debian/Ubuntu or sudo yum install openssl on CentOS/RHEL).
• You have obtained an SSL certificate (from a CA like Let's Encrypt, DigiCert, etc.).

You should have these files:

• Your domain certificate (eg, your_domain.crt )
• Private key (eg, your_domain.key )
• Intermediate certificate(s) from the CA (eg, intermediate.crt )
• Optionally, a CA bundle (often includes root intermediate)

1. Prepare SSL Certificate Files

Place your certificate files in a secure directory, typically:

 /etc/ssl/

or

 /etc/apache2/ssl/ # On Debian/Ubuntu
/etc/httpd/ssl/ # On CentOS/RHEL

Example:

 sudo cp your_domain.crt /etc/ssl/certs/
sudo cp your_domain.key /etc/ssl/private/
sudo cp intermediate.crt /etc/ssl/certs/

Make sure the private key is protected:

 sudo chmod 600 /etc/ssl/private/your_domain.key
sudo chown root:root /etc/ssl/private/your_domain.key

2. Enable Apache SSL Module

Ensure the SSL module is enabled:

On Debian/Ubuntu :

 sudo a2enmod ssl
sudo systemctl restart apache2

On CentOS/RHEL : The mod_ssl package must be installed:

 sudo yum install mod_ssl
# or on newer versions:
sudo dnf install mod_ssl

Then restart Apache:

 sudo systemctl restart httpd

3. Configure Apache Virtual Host for SSL

Edit your site's SSL configuration file.

On Debian/Ubuntu , edit:

 /etc/apache2/sites-available/your_site.conf

or create a new one like your_site-ssl.conf .

On CentOS/RHEL , edit:

 /etc/httpd/conf.d/your_site.conf

Add the following VirtualHost block:

 <VirtualHost *:443>
    ServerName www.yourdomain.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/your_domain.crt
    SSLCertificateKeyFile /etc/ssl/private/your_domain.key
    SSLCertificateChainFile /etc/ssl/certs/intermediate.crt

    <Directory /var/www/html>
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

? Note :

• SSLCertificateFile : Your domain certificate
• SSLCertificateKeyFile : Your private key
• SSLCertificateChainFile : Intermediate certificate (optional if bundle is included in certificate file)
• Some settings use SSLCACertificateFile for the full chain bundle.

Alternatively, you can combine your certificate and intermediate into one file:

 cat your_domain.crt intermediate.crt > combined.crt

Then use:

 SSLCertificateFile /etc/ssl/certs/combined.crt

and omit SSLCertificateChainFile .

4. Test Configuration and Restart Apache

Check for syntax errors:

 sudo apachectl configtest

or

 sudo apache2ctl configtest

If you see "Syntax OK", restart Apache:

On Ubuntu/Debian:

 sudo systemctl restart apache2

On CentOS/RHEL:

 sudo systemctl restart httpd

5. Redirect HTTP to HTTPS (Optional but Recommended)

To force all traffic to use HTTPS, edit your HTTP virtual host ( *:80 ) and add a redirect:

 <VirtualHost *:80>
    ServerName yourdomain.com
    Redirect permanent / https://yourdomain.com/
</VirtualHost>

Or use .htaccess if mod_rewrite is enabled:

 RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

6. Verify SSL Installation

Open a browser and visit:

 https://yourdomain.com

Check for the padlock icon.

Use online tools like:

• http://ipnx.cn/link/288d7e4b1fa80acd699c8287ec363e12
• http://ipnx.cn/link/7ba9f9814b71251de63c083324ef94bb

These will verify certificate chain, expiration, and security settings.

? Tips

• Keep your private key safe and never share it.
• Renew certificates before they expire (Let's Encrypt certs last 90 days).
• Automate renewal with certbot if using Let's Encrypt.

?? Bonus : Use Certbot (Let's Encrypt) for automatic setup:

 sudo certbot --apache -d yourdomain.com

It handles certificate issue, configuration, and auto-renewal.

---

That's it. Your Apache server should now be securely serving content over HTTPS. Just make sure to monitor expiration dates and keep your server updated.

The above is the detailed content of Apache SSL certificate installation guide. For more information, please follow other related articles on the PHP Chinese website!