Install an SSL Certificate on Apache Server

You can enable HTTPS secure access to your Apache server by installing an SSL certificate on it. This article describes how to install an SSL certificate on an Apache server.

Note

This document uses Apache version Apache/2.4.6 as an example. Before installation, make sure port 443 is not occupied. If port 443 is already in use, bind another port when installing the certificate.

Obtain the Certificate

1. After we issue the certificate for you, we will provide the certificate files in a compressed package (.zip). The package contains four folders corresponding to four certificate formats: Tomcat, Nginx, IIS, and Apache; the Apache server requires the certificates in the Apache folder.
2. The Apache folder will contain three files:

• domain_com.crt certificate file
• domain_com.key private key file
• domain_com.ca-bundle certificate chain file

Install the SSL Certificate

1. Copy the obtained domain_com.crt certificate file, domain_com.key private key file, and domain_com.ca-bundle certificate chain file from your local directory to the /etc/httpd/ssl directory on the Apache server.

Note

• If the /etc/httpd/ssl directory does not exist, you can create it using the mkdir -p /etc/httpd/ssl command
• Differences may exist between versions; the Apache directory may be /etc/apache2 in some cases

2. Check the httpd.conf configuration file in the /etc/httpd/conf directory, locate the Include conf.modules.d/*.conf configuration directive, and confirm that this directive is not commented out. If it is already commented out, remove the comment symbol (#) at the beginning of the line and save the configuration file.
3. Check the 00-ssl.conf configuration file in the /etc/httpd/conf.modules.d directory, locate the LoadModule ssl_module modules/mod_ssl.so configuration directive, and confirm that this directive is not commented out. If it is already commented out, remove the leading comment symbol (#) and save the configuration file.

Note

If LoadModule ssl_module modules/mod_ssl.so is not found in the above configuration file, please confirm whether the mod_ssl.so module has been installed. If the mod_ssl.so module is not installed, you can install it by running the yum install mod_ssl command.

4. Edit the ssl.conf configuration file under the /etc/httpd/conf.d directory. Modify the following content:

<VirtualHost *:443>
        DocumentRoot /var/www/html
        #启用 SSL 功能
        SSLEngine on		
        #证书文件的路径
        SSLCertificateFile      /etc/httpd/ssl/domain_com.crt
        #私钥文件的路径
        SSLCertificateKeyFile   /etc/httpd/ssl/domain_com.key
        #证书链文件的路径
        SSLCertificateChainFile /etc/httpd/ssl/domain_com.ca-bundle
</VirtualHost>

5. Restart the Apache server after saving the configuration file.

Test the SSL certificate

Enter the domain name bound with the SSL certificate in the browser address bar to test whether your SSL certificate is installed successfully. If successful, a security padlock icon will appear in the browser address bar, and you can click it to view certificate information.

Security configuration for automatic HTTP to HTTPS redirect (optional)

If you need to automatically redirect HTTP requests to HTTPS, you can configure it with the following steps:

1. Edit the httpd.conf configuration file in the /etc/httpd/conf directory. Check whether LoadModule rewrite_module modules/mod_rewrite.so exists in the configuration file. If it exists, remove the leading comment symbol (#); if it does not exist, add the line LoadModule rewrite_module modules/mod_rewrite.so, then save the configuration file.
2. Open the http.conf file and add the following content to the configuration file:

<VirtualHost *:80>
# 新增
RewriteEngine on
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)?$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
</VirtualHost>

3. Restart the Apache server to access via the domain name and enable automatic redirection from HTTP to HTTPS.