Configure SSL/TLS on Apache — From Issuance to Deployment

Enable Apache TLS modules, install certificates, configure virtual hosts, and optimize security.

CertOneDec 27, 20194 min read

Apache is a widely used web server. This guide covers TLS modules, certificate installation, virtual hosts, and security settings to help you deploy HTTPS correctly.

1. Preparation

1. Obtain an SSL/TLS certificate

Before configuring Apache, prepare:

A certificate issued through CertOne, Let's Encrypt, or another provider
A certificate file (.crt or .pem)
A private key file (.key)
The intermediate chain file (chain.crt), if required

2. Upload certificate files

Upload the files to your server:

# Create the certificate directory.
sudo mkdir -p /etc/apache2/ssl

# Upload the certificate files.
sudo cp certificate.crt /etc/apache2/ssl/
sudo cp private.key /etc/apache2/ssl/
sudo cp chain.crt /etc/apache2/ssl/

# Set file permissions.
sudo chmod 600 /etc/apache2/ssl/private.key
sudo chmod 644 /etc/apache2/ssl/certificate.crt
sudo chmod 644 /etc/apache2/ssl/chain.crt

2. Enable TLS modules

1. Enable mod_ssl

# Ubuntu/Debian
sudo a2enmod ssl
sudo systemctl restart apache2

# CentOS/RHEL
sudo yum install mod_ssl
sudo systemctl restart httpd

2. Enable other required modules

# Enable mod_rewrite for HTTP-to-HTTPS redirects.
sudo a2enmod rewrite
sudo a2enmod headers

# Restart Apache.
sudo systemctl restart apache2

3. Basic TLS configuration

1. Edit the virtual host

Edit the site configuration, usually under /etc/apache2/sites-available/:

sudo nano /etc/apache2/sites-available/example.com-ssl.conf

2. Add an HTTPS virtual host

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    
    # TLS configuration
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/certificate.crt
    SSLCertificateKeyFile /etc/apache2/ssl/private.key
    SSLCertificateChainFile /etc/apache2/ssl/chain.crt
    
    # TLS protocol configuration
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    SSLHonorCipherOrder on
    
    # Document root
    DocumentRoot /var/www/html
    <Directory /var/www/html>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
    
    # Error log
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

3. Enable the site

# Enable the HTTPS site.
sudo a2ensite example.com-ssl.conf

# Test the configuration.
sudo apache2ctl configtest

# Restart Apache if the test passes.
sudo systemctl restart apache2

Redirect HTTP requests to HTTPS

1. Redirect the HTTP virtual host

Edit the HTTP virtual host configuration:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    
    # Redirect all HTTP requests to HTTPS.
    Redirect permanent / https://example.com/
</VirtualHost>

2. Redirect with rewrite rules

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    
    RewriteEngine on
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</VirtualHost>

5. Optimize TLS configuration

1. Complete security configuration

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    
    # TLS configuration
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/certificate.crt
    SSLCertificateKeyFile /etc/apache2/ssl/private.key
    SSLCertificateChainFile /etc/apache2/ssl/chain.crt
    
    # Allow only TLS 1.2 and 1.3.
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    
    # TLS cipher suites
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
    SSLHonorCipherOrder on
    
    # OCSP Stapling
    SSLUseStapling on
    SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"
    
    # Security headers
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    
    # Document root
    DocumentRoot /var/www/html
    <Directory /var/www/html>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
    
    # Logs
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

2. Global TLS configuration

Edit /etc/apache2/conf-available/ssl-params.conf:

# Modern TLS configuration
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder on

# OCSP Stapling
SSLUseStapling on
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"

# Security headers
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"

Enable the configuration:

sudo a2enconf ssl-params
sudo systemctl restart apache2

6. Multiple domains

1. One certificate for multiple domains

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com api.example.com blog.example.com
    
    # Add the remaining TLS settings here.
</VirtualHost>

2. Multiple certificates with SNI

# First domain
<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/example.com.crt
    SSLCertificateKeyFile /etc/apache2/ssl/example.com.key
    SSLCertificateChainFile /etc/apache2/ssl/example.com.chain.crt
    # Add the remaining site configuration here.
</VirtualHost>

# Second domain
<VirtualHost *:443>
    ServerName another.com
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/another.com.crt
    SSLCertificateKeyFile /etc/apache2/ssl/another.com.key
    SSLCertificateChainFile /etc/apache2/ssl/another.com.chain.crt
    # Add the remaining site configuration here.
</VirtualHost>

7. Troubleshooting

1. Incomplete certificate chain

Problem: the browser reports an untrusted certificate.

Resolution:

# Ensure the intermediate chain is configured.
SSLCertificateChainFile /etc/apache2/ssl/chain.crt

2. TLS module disabled

Problem: Apache will not start or TLS does not work.

Resolution:

# Check whether mod_ssl is enabled.
apache2ctl -M | grep ssl

# Enable the module if necessary.
sudo a2enmod ssl
sudo systemctl restart apache2

3. Permission problems

Problem: Apache cannot read the certificate files.

Resolution:

# Check file permissions.
ls -l /etc/apache2/ssl/

# Set the correct permissions.
sudo chmod 644 /etc/apache2/ssl/*.crt
sudo chmod 600 /etc/apache2/ssl/*.key
sudo chown root:root /etc/apache2/ssl/*

8. Test TLS configuration

1. Test with SSL Labs

Visit https://www.ssllabs.com/ssltest/, enter your domain, and review the TLS configuration grade.

2. Command-line testing

# Test the TLS connection.
openssl s_client -connect example.com:443 -servername example.com

# Check Apache configuration.
sudo apache2ctl configtest

9. Automatic renewal

1. Renew automatically with CertOne

For certificates issued through CertOne:

Enable automatic renewal in CertOne
Configure automatic deployment to the server
Renewed certificates will be deployed automatically

2. Renew automatically with Certbot

# Install Certbot.
sudo apt-get install certbot python3-certbot-apache

# Request a certificate and configure Apache automatically.
sudo certbot --apache -d example.com -d www.example.com

# Test automatic renewal.
sudo certbot renew --dry-run

Best practices

1. Security configuration

✅ Use TLS 1.2 or later
✅ Disable insecure cipher suites
✅ Enable HSTS
✅ Enable OCSP stapling when supported by the certificate's CA
✅ Configure security response headers

2. Performance optimization

✅ Enable TLS session caching
✅ Use strong encryption with appropriate resource requirements
✅ Use OCSP stapling where supported to reduce latency

3. Certificate management

✅ Renew certificates regularly
✅ Monitor certificate expiration
✅ Back up certificates and private keys
✅ Use automated certificate management tools

Conclusion

Correct Apache TLS configuration helps secure your website. This guide covers how to:

✅ Install and configure certificates
✅ Enable the TLS module
✅ Optimize TLS security settings
✅ Configure HTTP-to-HTTPS redirects
✅ Enable HSTS and supported OCSP stapling
✅ Automate certificate renewal

Renew certificates regularly and monitor your TLS settings. CertOne offers free certificate issuance, certificate management, and automatic deployment.

1. Preparation​

1. Obtain an SSL/TLS certificate​

2. Upload certificate files​

2. Enable TLS modules​

1. Enable mod_ssl​

2. Enable other required modules​

3. Basic TLS configuration​

1. Edit the virtual host​

2. Add an HTTPS virtual host​

3. Enable the site​

Redirect HTTP requests to HTTPS​

1. Redirect the HTTP virtual host​

2. Redirect with rewrite rules​

5. Optimize TLS configuration​

1. Complete security configuration​

2. Global TLS configuration​

6. Multiple domains​

1. One certificate for multiple domains​

2. Multiple certificates with SNI​

7. Troubleshooting​

1. Incomplete certificate chain​

2. TLS module disabled​

3. Permission problems​

8. Test TLS configuration​

1. Test with SSL Labs​

2. Command-line testing​

9. Automatic renewal​

1. Renew automatically with CertOne​

2. Renew automatically with Certbot​

Best practices​

1. Security configuration​

2. Performance optimization​

3. Certificate management​

Conclusion​

1. Preparation

1. Obtain an SSL/TLS certificate

2. Upload certificate files

2. Enable TLS modules

1. Enable mod_ssl

2. Enable other required modules

3. Basic TLS configuration

1. Edit the virtual host

2. Add an HTTPS virtual host

3. Enable the site

Redirect HTTP requests to HTTPS

1. Redirect the HTTP virtual host

2. Redirect with rewrite rules

5. Optimize TLS configuration

1. Complete security configuration

2. Global TLS configuration

6. Multiple domains

1. One certificate for multiple domains

2. Multiple certificates with SNI

7. Troubleshooting

1. Incomplete certificate chain

2. TLS module disabled

3. Permission problems

8. Test TLS configuration

1. Test with SSL Labs

2. Command-line testing

9. Automatic renewal

1. Renew automatically with CertOne

2. Renew automatically with Certbot

Best practices

1. Security configuration

2. Performance optimization

3. Certificate management

Conclusion