Installing a Private Certificate on an Apache Server

Prerequisites

• The certificate has been issued.
• You have downloaded the private certificate in the format that is supported by Apache. For details, see Downloading a Certificate.
• You have used a system-generated CSR to apply for the certificate.

Constraints

• Before installing the certificate, enable port 443 on the server where the private certificate is installed and add port 443 to the security group. Otherwise, HTTPS cannot be enabled after the installation.
• A root CA must be added to the trusted client CA list so that all server certificates issued by the root CA can be trusted by the client. For details, see Trusting a Private Root CA.
• If a domain name maps to multiple servers, deploy the certificate on each server.
• A private certificate can only be installed on the server that maps to the domain name associated with the certificate. Otherwise, the web browser will display a message indicating that the domain name is insecure.

Procedure

The installation process is as follows (for Apache 2.4.6 servers running CentOS 7):

Step 1: Obtaining Files → Step 2: Creating a Directory → Step 3: Modifying Configuration Files → Step 4: Restarting Apache → Step 5: Verifying the Result

Step 1: Obtaining Files

Decompress the downloaded certificate file on your local PC.

You will obtain certificate files ca.crt and server.crt and private key file server.key.

• ca.crt contains one segment of intermediate CA certificate code: -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.
• server.crt contains one segment of server certificate code: -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.
• server.key contains one segment of private key code: -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY-----.

Step 2: Creating a Directory

Create a cert directory in the Apache installation directory, and copy the server.key, server.crt, and ca.crt files to the cert directory.

Step 3: Modifying Configuration Files

Before modifying the configuration file, back up the configuration file. You are advised to deploy the configuration file in the test environment and then configure it on the production environment to avoid service interruptions caused by incorrect configurations.

1. Open the conf.d/ssl.conf file in the Apache root directory.
2. Configure the domain name associated with the certificate.
   Find and modify the following parameter:

   ServerName www.example.com:443 

   The complete configuration is as follows (www.domain.com is used as an example):

   ServerName www.domain.com:443 #Replace www.domain.com with the domain name of your server.

3. Configure the public key for the certificate.

   Find and modify the following parameter:

   SSLCertificateFile "${SRVROOT}/conf/server.crt" 

   Set the value to the path of the server.crt file. An example of the path is cert/server.crt.

   The complete configuration is as follows:

   SSLCertificateFile "cert/server.crt"

4. Configure the private key for the certificate.

   Find and modify the following parameter:

   SSLCertificateKeyFile "${SRVROOT}/conf/server.key" 

   Set the value to the path of the server.key file. An example of the path is cert/server.key.

   The complete configuration is as follows:

   SSLCertificateKeyFile "cert/server.key"

5. Configure the certificate chain.

   Find and modify the following parameter:

   #SSLCertificateChainFile "${SRVROOT}/conf/server-ca.crt" 

   Delete the comment tag # at the beginning of the line. Set this parameter to the path of the ca.crt file. An example of the path is cert/ca.crt.

   The complete configuration is as follows:

   SSLCertificateChainFile "cert/ca.crt"

6. Save the ssl.conf file and exit.

Step 4: Restarting Apache

Restart the Apache service for the configuration to take effect:

1. Run the service named stop command to stop the Apache server.
2. Run the service httpd start command to start the Apache server.

Verifying the Result

After the deployment succeeds, in the address bar of the browser, enter https://Domain name and press Enter.

If a security padlock is displayed in the address bar of the browser, the certificate has been installed successfully.