How to Install an SSL Certificate on Apache

This guide walks through installing a free Let's Encrypt SSL certificate on Apache HTTP Server (httpd), forcing HTTPS, and checking that the certificate chain is served correctly.

1. Get your certificate files

Generate a free certificate on MTFreeSSL and download the ZIP. For Apache 2.4.8 and newer you need fullchain.pem and private.key. Older Apache versions use certificate.pem and ca-bundle.pem separately (see step 3).

2. Enable mod_ssl and upload the files

On Debian and Ubuntu:

sudo a2enmod ssl
sudo mkdir -p /etc/ssl/example.com
sudo cp fullchain.pem private.key /etc/ssl/example.com/
sudo chmod 600 /etc/ssl/example.com/private.key

On RHEL, CentOS, AlmaLinux and Rocky Linux install the module with sudo dnf install mod_ssl.

3. Configure the HTTPS VirtualHost

Create or edit /etc/apache2/sites-available/example.com-ssl.conf (Debian/Ubuntu) or /etc/httpd/conf.d/example.com-ssl.conf (RHEL family):

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example.com

    SSLEngine on
    SSLCertificateFile    /etc/ssl/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/ssl/example.com/private.key

    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
</VirtualHost>

On Apache older than 2.4.8, point to the separate files instead:

SSLCertificateFile      /etc/ssl/example.com/certificate.pem
SSLCertificateKeyFile   /etc/ssl/example.com/private.key
SSLCertificateChainFile /etc/ssl/example.com/ca-bundle.pem

On Debian/Ubuntu enable the site with sudo a2ensite example.com-ssl.

4. Redirect HTTP to HTTPS

In the port 80 VirtualHost, redirect everything except ACME challenge files:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example.com

    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</VirtualHost>

This needs mod_rewrite: sudo a2enmod rewrite.

5. Test and restart Apache

sudo apachectl configtest
sudo systemctl reload apache2   # or: sudo systemctl reload httpd

6. Verify the certificate

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

You should see two certificates in the output: yours and the Let's Encrypt intermediate. If only one appears, Apache is not sending the chain — use fullchain.pem or add SSLCertificateChainFile.

Troubleshooting

• "Invalid command 'SSLEngine'" — mod_ssl is not loaded. Enable it and reload.
• "Private key does not match" — the key and certificate come from different orders. Download both from the same certificate.
• Site still shows an old certificate — another VirtualHost on port 443 matches first. Check with sudo apachectl -S.

Renewing

Certificates are valid for 90 days. Generate a new one before it expires, replace the files and reload Apache.