How to Install an SSL Certificate on Apache

How do I install an SSL certificate on Apache?

To install an SSL certificate on Apache, copy your certificate, the CA’s intermediate certificates and your private key to the server, reference them in a <VirtualHost *:443> block with SSLCertificateFile and SSLCertificateKeyFile, then run a config test and reload Apache. Serve the full chain, not just your own certificate, or some clients will reject the connection.

This guide is the Apache-specific part of our overview on how to install an SSL certificate. It assumes the certificate is already issued and you still have the private key from your CSR (certificate signing request, the file you sent to the CA). If you have not created one yet, use our CSR generator or OpenSSL on the server.

Item	What you need
Apache version	2.4.8 or newer (chain can live in the certificate file)
Module	mod_ssl enabled
Files	Server certificate, intermediate (CA bundle), private key
Access	Root or sudo (Linux), Administrator (Windows)
Port	443 open in the firewall

Step-by-step: install SSL certificate on Apache (Linux)

The commands below use Ubuntu/Debian paths. On RHEL, AlmaLinux or Rocky Linux the service is called httpd and the SSL config lives in /etc/httpd/conf.d/ssl.conf.

1. Upload and protect the files

Your CA delivers the server certificate (for example example_com.crt) and one or more intermediate certificates, often named .ca-bundle or intermediate.crt. Copy them, together with your private key, to the server:

sudo mkdir -p /etc/ssl/example.com
sudo cp example_com.crt example_com.ca-bundle /etc/ssl/example.com/
sudo cp example_com.key /etc/ssl/private/
sudo chmod 600 /etc/ssl/private/example_com.key

Apache needs PEM files: plain text that starts with -----BEGIN CERTIFICATE-----. If you received a .p7b or .pfx file instead, convert it to PEM first; our SSL decoder page explains the formats. Before you edit any config, confirm that the key belongs to the certificate. Both commands must print the same hash:

openssl x509 -noout -pubkey -in example_com.crt | openssl sha256
openssl pkey -pubout -in /etc/ssl/private/example_com.key | openssl sha256

If the hashes differ, the certificate was issued for another CSR. Find the matching key or reissue the certificate with a new CSR.

2. Combine certificate and chain

Since Apache 2.4.8, SSLCertificateFile can hold your certificate followed by the intermediates, and the older SSLCertificateChainFile directive is obsolete. Order matters: your server certificate first, then the intermediates.

cat example_com.crt example_com.ca-bundle > example_com_fullchain.crt

Why the chain matters, and how to fix a broken one, is covered in our guide to the certificate chain.

3. Configure the virtual host

Enable the module (Ubuntu/Debian) and edit the site’s HTTPS virtual host, for example /etc/apache2/sites-available/example.com-ssl.conf:

sudo a2enmod ssl

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example.com

    SSLEngine on
    SSLCertificateFile    /etc/ssl/example.com/example_com_fullchain.crt
    SSLCertificateKeyFile /etc/ssl/private/example_com.key
</VirtualHost>

Then enable the site with sudo a2ensite example.com-ssl. On RHEL-based systems install the module with sudo dnf install mod_ssl and place the block in a file under /etc/httpd/conf.d/.

4. Test and reload

sudo apachectl configtest
sudo systemctl reload apache2      # RHEL: sudo systemctl reload httpd

A reload applies the new certificate without dropping open connections. Only restart if the reload fails or you just enabled mod_ssl.

Tip: Redirect plain HTTP to HTTPS in the *:80 virtual host with Redirect permanent / https://example.com/ once the HTTPS site works. Do it after testing, not before.

Install SSL certificate on Apache for Windows

On Windows builds of Apache (for example from Apache Lounge), the directives are identical. Open conf\httpd.conf and uncomment these lines:

LoadModule ssl_module modules/mod_ssl.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
Include conf/extra/httpd-ssl.conf

Then set SSLCertificateFile and SSLCertificateKeyFile in conf\extra\httpd-ssl.conf to your files, using forward slashes (C:/Apache24/conf/ssl/example_com_fullchain.crt). Test with httpd.exe -t and restart the Apache service.

Wildcard certificates and Tomcat

To install a wildcard SSL certificate on Apache, use the same two directives in every virtual host that shares the wildcard; each host can point at the same files. Apache Tomcat configures TLS in conf/server.xml through a <Certificate> element inside <SSLHostConfig>, using a PKCS#12 keystore or PEM files.

Where does Apache store SSL certificate files?

Apache has no certificate store of its own: it reads whatever files the SSLCertificateFile and SSLCertificateKeyFile directives point to. Distributions do ship conventional locations, shown below.

System	Certificates	Private keys	SSL config
Ubuntu / Debian	/etc/ssl/certs/	/etc/ssl/private/	/etc/apache2/sites-available/
RHEL / AlmaLinux / Rocky	/etc/pki/tls/certs/	/etc/pki/tls/private/	/etc/httpd/conf.d/ssl.conf
Windows (Apache Lounge)	any folder, e.g. C:\Apache24\conf\ssl\	same folder, restricted	conf\extra\httpd-ssl.conf

To find the files a running site really uses, search the config: grep -Ri "SSLCertificate" /etc/apache2/ (or /etc/httpd/). For IIS, Nginx, Java keystores and desktops, see where certificates are stored on other systems.

Tip: Keep the private key readable by root only (chmod 600). Apache’s parent process reads it as root before dropping privileges.

How do I host several SSL sites on one Apache server?

Give each site its own <VirtualHost *:443> block with its own ServerName and certificate files. Apache uses SNI (Server Name Indication, the hostname the browser sends at the start of the TLS handshake) to pick the matching certificate, so all sites can share one IP address.

<VirtualHost *:443>
    ServerName shop.example.com
    SSLEngine on
    SSLCertificateFile    /etc/ssl/shop/shop_fullchain.crt
    SSLCertificateKeyFile /etc/ssl/private/shop.key
</VirtualHost>

<VirtualHost *:443>
    ServerName blog.example.org
    SSLEngine on
    SSLCertificateFile    /etc/ssl/blog/blog_fullchain.crt
    SSLCertificateKeyFile /etc/ssl/private/blog.key
</VirtualHost>

The first *:443 virtual host Apache loads is the default for clients that send no SNI. Run apachectl -S to list which host answers for which name.

How do I update an Apache SSL certificate?

Swap the files, update the paths, test, reload. A graceful reload is enough; you do not need downtime. As of October 2026, publicly trusted TLS certificates are valid for at most 200 days, dropping to 100 days on 15 March 2027 under CA/Browser Forum ballot SC-081, so you will repeat this step more often than in the past. When and how to renew an SSL certificate before it expires is covered in its own guide.

Common Apache SSL errors

Error or symptom	Likely cause	Fix
AH02565: Certificate and private key ... do not match	Key from a different CSR	Use the key generated with this certificate’s CSR, or reissue
Works in desktop browsers, fails on Android or in curl	Intermediate missing	Append the CA bundle to the certificate file
Old certificate still served	Wrong virtual host edited, or no reload	Check apachectl -S, then reload
Apache will not start after the change	Wrong path or typo in a directive	Run apachectl configtest and read the line it names
Connection refused on port 443	No Listen 443 or firewall closed	Enable mod_ssl, open port 443

After any change, run your domain through our SSL checker. It shows the certificate Apache actually serves, whether the chain is complete and when it expires.