SSL Certificate Installation - Apache Open SSL

This guide explains how to install an SSL certificate on a server running Apache with OpenSSL (mod_ssl). Once your certificate has been issued you will have a small set of files to place on the server, a few lines to add to your Apache configuration, and a restart to apply the change. ASEOHosting also publishes a step by step PDF, "How to Install an SSL Certificate in Apache OpenSSL", which walks through the same process with screenshots.

What you need before you start

An SSL certificate installation involves three related files. Have all of them to hand before you begin:

• Your certificate file (commonly yourdomain.crt), issued by the certificate authority.
• Your private key (commonly yourdomain.key), generated on the server at the same time as the certificate signing request (CSR). This file never leaves your server and must be kept secret.
• The CA bundle / intermediate chain (commonly ca-bundle.crt or chain.crt), supplied by the certificate authority so browsers can link your certificate back to a trusted root.

You will also need root or sudo access to the server, or a hosting control panel that lets you edit the Apache virtual host. Make sure mod_ssl is installed and enabled and that port 443 is open in the firewall.

Why the chain file matters

A browser only trusts your site if it can build an unbroken path from your certificate up to a root certificate it already knows. That path runs through one or more intermediate certificates. If you install the site certificate but omit the intermediate chain, some browsers and many mobile devices will show a "not trusted" warning even though the certificate itself is valid. The diagram below shows the chain that Apache serves to visitors.

Installing the certificate on Apache

1. Upload the three files to a directory the web server can read, for example /etc/ssl/yourdomain/. Keep the private key readable only by root.
2. Open the SSL virtual host configuration. Depending on the distribution this is a file such as /etc/httpd/conf.d/ssl.conf, /etc/apache2/sites-available/yourdomain-ssl.conf, or a dedicated <VirtualHost *:443> block.
3. Point Apache at each file inside the <VirtualHost *:443> block:
   • SSLCertificateFile /etc/ssl/yourdomain/yourdomain.crt
   • SSLCertificateKeyFile /etc/ssl/yourdomain/yourdomain.key
   • SSLCertificateChainFile /etc/ssl/yourdomain/ca-bundle.crt
   On newer Apache builds (2.4.8 and later) you can append the intermediate to the certificate file and use only SSLCertificateFile, but keeping the chain separate works on every version.
4. Make sure SSLEngine on is set in the same block and that the server is listening on port 443.
5. Test the configuration before restarting: run apachectl configtest (or httpd -t). Fix any syntax errors it reports.
6. Restart Apache to load the certificate: systemctl restart httpd or systemctl restart apache2.

Confirm it worked

Visit your site with https:// and check for the padlock. It is worth loading the site in more than one browser, and on a phone, because mobile devices are the strictest about a missing intermediate chain. If you see a trust warning, the chain file is the usual culprit. For a hardened configuration, including which TLS protocols and ciphers to enable, the Mozilla SSL Configuration Generator produces ready to paste Apache directives that stay current with best practice: see Mozilla's SSL configuration generator.

Related help

If you have not bought a certificate yet, or you are not sure which validation level you need, our SSL certificates page explains the options. For more walkthroughs covering cPanel, other web servers and common installation errors, browse the SSL certificates FAQ. On ASEOHosting SEO plans each site can sit on its own dedicated Class C IP, which keeps certificates and hostnames cleanly separated across a network of sites; the value of that separation is defensive, it protects one site's reputation and configuration from its neighbours rather than being a ranking boost in itself.