Installing a certificate on Apache

Prerequisites

• Access to the server with root rights or sudo.
• Apache is installed and running.
• The combined PEM file from regfish, containing the server certificate and the intermediates (certificate-example.com.pem).
• The private key from the certificate request (private.key), see creating a CSR.

After issuance you find the PEM file in the dash under SSL/TLS → your certificate → downloads, as the full PEM file or inside the ZIP package.

Placing the files

sudo mkdir -p /etc/apache2/ssl
sudo cp certificate-example.com.pem /etc/apache2/ssl/
sudo cp private.key /etc/apache2/ssl/

The permissions are not a detail: the key must be readable by root only.

sudo chmod 644 /etc/apache2/ssl/certificate-example.com.pem
sudo chmod 600 /etc/apache2/ssl/private.key

Enable the SSL module if that has not happened yet:

sudo a2enmod ssl

Adjusting the virtual host

Open the configuration of the website, often /etc/apache2/sites-available/default-ssl.conf:

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile      /etc/apache2/ssl/certificate-example.com.pem
    SSLCertificateKeyFile   /etc/apache2/ssl/private.key

    # Recommended settings
    SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite          HIGH:!aNULL:!MD5
</VirtualHost>

No separate chain file needed

Because the PEM file already contains the intermediates, you point SSLCertificateFile straight at it. As of Apache 2.4.8 SSLCertificateChainFile is deprecated; the chain belongs in the same file.

Enable, test, restart

sudo a2ensite default-ssl
sudo apachectl configtest
sudo systemctl restart apache2

The configtest before the restart is the step not worth skipping: otherwise a typo in a path means Apache does not come back up at all.

Checking the installation

Open the website over HTTPS and make sure the browser reports no certificate errors. A test service such as the Qualys SSL Labs server test checks more thoroughly and also catches an incomplete chain, which browsers often still forgive.

The certificate watch reports every new certificate issued for this name, including one ordered by somebody else. It does not watch your own certificate for expiry: the automation in the next section is what covers that.

All of this automatically

If you would rather not repeat this on every renewal, automate issuance and installation with certbro or the recipe ACME certificates with lego.