How to Install an SSL Certificate on Apache
To install an SSL certificate on Apache, either run sudo certbot --apache -d example.in after enabling mod_ssl, or for a purchased certificate add SSLCertificateFile with the full chain and SSLCertificateKeyFile to a port 443 VirtualHost. Run apachectl configtest, reload Apache, and confirm the chain with openssl s_client.
For Linux VPS and server admins securing Apache sites with free Let's Encrypt or paid SSL certificates.
knowledge
- Read time
- 6 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Which way should you install an SSL certificate on Apache?
Use Certbot for a free Let's Encrypt certificate that installs and renews itself, or install a purchased certificate manually when you need a wildcard, OV/EV validation or a certificate from a specific CA. Either way, Apache needs the same three things in a port 443 VirtualHost: the certificate, its private key and the intermediate chain.
| Point | Certbot (Let's Encrypt) | Purchased certificate |
|---|---|---|
| Key and CSR | Created automatically | You generate them with OpenSSL |
| File location | /etc/letsencrypt/live/example.in/ | A folder you choose, e.g. /etc/ssl/example.in/ |
| Validity and renewal | 90 days, renewed automatically by a timer | Per the CA's term, renewed by you |
| Validation | HTTP or DNS challenge | Email, DNS or file (DV); company checks (OV/EV) |
| Best for | Most public websites | Wildcards, organisation validation, contracts naming a CA |
Pick one path per hostname; do not mix both on the same name.
How do you install a free SSL certificate on Apache with Certbot?
Install Certbot and its Apache plugin, enable mod_ssl, then run certbot --apache for every hostname; Certbot obtains the certificate, writes the 443 VirtualHost and can add the HTTP-to-HTTPS redirect.
# Ubuntu / Debian
sudo apt install -y certbot python3-certbot-apache
sudo a2enmod ssl && sudo systemctl restart apache2
sudo certbot --apache -d example.in -d www.example.in
# prove unattended renewal will work
sudo certbot renew --dry-run
systemctl list-timers | grep certbotThe challenge passes only if DNS for each name points at this server, port 80 is reachable from the internet and Apache is running. A CDN or proxy in front often breaks the HTTP challenge; use the DNS challenge or pause the proxy. On AlmaLinux or Rocky, enable EPEL and install certbot python3-certbot-apache with dnf.
How do you install a purchased SSL certificate on Apache?
Generate a private key and CSR on the server, submit only the CSR to the CA, then upload the issued certificate and intermediate bundle and confirm they match the key before editing Apache.
sudo mkdir -p /etc/ssl/example.in && cd /etc/ssl/example.in
sudo openssl req -new -newkey rsa:2048 -nodes \
-keyout example.in.key -out example.in.csr \
-subj "/C=IN/ST=Rajasthan/L=Jaipur/O=Example/CN=example.in" \
-addext "subjectAltName=DNS:example.in,DNS:www.example.in"
sudo chmod 600 example.in.key
# after issue: both hashes must match (works for RSA and ECDSA)
openssl x509 -in example.in.crt -noout -pubkey | openssl sha256
openssl pkey -in example.in.key -pubout | openssl sha256The CA usually emails your certificate plus an intermediate bundle (often called ca-bundle). A certificate paired with the wrong key stops Apache starting, so do the hash check first. Full CSR guidance, including panels and ECDSA keys, is in how to generate a CSR.
What does the Apache SSL VirtualHost look like?
One <VirtualHost *:443> block per site with SSLEngine on, the certificate and key paths, and the same ServerName and DocumentRoot as the port 80 block. On Apache 2.4.8 and later, put the certificate and intermediates in one full-chain file; SSLCertificateChainFile is deprecated.
# /etc/apache2/sites-available/example.in-ssl.conf
<VirtualHost *:443>
ServerName example.in
ServerAlias www.example.in
DocumentRoot /var/www/example.in/public
SSLEngine on
SSLCertificateFile /etc/ssl/example.in/fullchain.crt
SSLCertificateKeyFile /etc/ssl/example.in/example.in.key
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
</VirtualHost>
# port 80 block: send everything to HTTPS
<VirtualHost *:80>
ServerName example.in
ServerAlias www.example.in
Redirect permanent / https://example.in/
</VirtualHost>
# build the full chain, then enable
cat example.in.crt ca-bundle.crt | sudo tee fullchain.crt >/dev/null
sudo a2ensite example.in-ssl.confOn RHEL-family systems place the file in /etc/httpd/conf.d/ and install mod_ssl with dnf; there is no a2ensite step.
How do you test the configuration and confirm HTTPS works?
Run apachectl configtest until it prints Syntax OK, reload Apache, then check the certificate the server actually presents with openssl s_client. A reload keeps existing connections alive; a failed restart takes every site down.
sudo apachectl configtest(RHEL:sudo httpd -t).sudo systemctl reload apache2.openssl s_client -connect example.in:443 -servername example.in </dev/null: read the subject, issuer and "Verify return code: 0 (ok)".curl -I http://example.in: expect one 301 to the https address.- Open the site and check the browser console for mixed-content warnings.
The free SSL checker confirms the chain from outside your network. If the browser warns but OpenSSL verifies, an image or script is probably still loading over http; moving a site to HTTPS covers fixing those.
Which Apache SSL errors are common, and how are they fixed?
Most failures are a wrong file path, a certificate–key mismatch, a missing intermediate, or a name not listed in the certificate. Match the message, fix the named file, and test again.
| Message | Cause | Fix |
|---|---|---|
| AH00526 … file does not exist | Wrong path or file not uploaded | Use absolute paths; check with ls -l |
| Private key does not match the certificate | Certificate issued for a different key | Run the hash check; reissue if needed |
| SSL_ERROR_RX_RECORD_TOO_LONG | Plain HTTP served on 443 | Confirm SSLEngine on and mod_ssl is enabled |
| ERR_CERT_COMMON_NAME_INVALID | Hostname missing from the SAN list | Reissue including that name, such as www |
| Unable to get local issuer certificate | Intermediate chain missing | Use a full-chain file |
| AH00072 address already in use | Another service holds 80 or 443 | sudo ss -tlnp | grep -E ':80|:443', stop it |
How do renewal and paid certificates from WebJi® work?
Certbot renews Let's Encrypt certificates automatically when about 30 days remain; a purchased certificate must be renewed before its expiry and the files replaced in place, after which a reload picks them up. Keep the dry-run in your monitoring so a broken challenge is caught weeks early.
WebJi® sells Sectigo Positive SSL for one domain and its www name at ₹1,800 a year and the Positive SSL Wildcard at ₹7,500 a year, before 18% GST, on the SSL certificate page; OV and EV certificates are quoted before payment. Email support@webji.services with the hostnames to cover; replies come 24/7 in Hindi and English. A Linux VPS gives the root access this guide assumes.
Frequently asked questions
Can one Apache server host several HTTPS sites on one IP?
Yes. Apache uses Server Name Indication (SNI), which every current browser supports, to pick the right certificate per hostname. Give each site its own 443 VirtualHost with its own ServerName and certificate files.
Should I use a wildcard certificate or Certbot for each subdomain?
For a few known subdomains, Certbot certificates per name are free and simple. A wildcard suits many or frequently created subdomains. Let's Encrypt also issues wildcards, but only through the DNS challenge, which needs DNS API access for automatic renewal.
How do I move an SSL certificate to a new Apache server?
Copy the certificate, chain and private key, keep the key at permissions 600 owned by root, and recreate the VirtualHost. If the old server keeps running, reissuing a new key is safer than sharing one key between machines.
Do I need to restart Apache after renewing?
A reload is enough. Certbot's Apache plugin reloads automatically after renewal. For a manually renewed certificate, replace the files at the same paths and run systemctl reload apache2.
Directives checked against Apache 2.4 mod_ssl and Certbot documentation · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.