Installing an SSL Certificate on an Apache Server

Prerequisites

• The certificate is in the Issued status.

• You have downloaded the SSL certificate. For details, see Downloading a Certificate.
• You have installed the mod_ssl.so module (for enabling SSL) on the Apache server.

Constraints

• Before installing the certificate, enable port 443 on the server where the SSL certificate is installed and add port 443 to the security group. Otherwise, HTTPS cannot be enabled after the installation.
• If a domain name maps to multiple servers, deploy the certificate on each server.
• The domain name to be run on the target server must be the same as the one associated with the certificate. Otherwise, the web browser will display a message indicating that the domain name is insecure.

Procedure

The installation process is as follows (for Apache 2.4.6 servers running CentOS 7):

Step 1: Obtaining Files → Step 2: Creating a Directory → Step 3: Modifying Configuration Files → Step 4: Restarting Apache → Verifying the Result

Step 1: Obtaining Files

Before installing a certificate, obtain the certificate file and password file. Perform the following operations based on the value selected for CSR when applying for a certificate:

• If you select System generated CSR for CSR when applying for a certificate, perform the operations according to the instructions in System generated CSR.
• If you select Upload a CSR for CSR when applying for a certificate, perform the operations according to the instructions in Upload a CSR.

Detailed operations are as follows:

• System generated CSR
  1. Decompress the downloaded certificate file on your local PC.
     The downloaded file contains the Apache, IIS, Nginx, and Tomcat folders as well as the domain.csr file. Figure 1 shows an example.

     Figure 1 Decompressing an SSL certificate package on a local computer
     
  2. Obtain the certificate files Certificate ID_Domain name bound to the certificate_ca.crt and Certificate ID_Domain name bound to the certificate_server.crt, and private key file Certificate ID_Domain name bound to the certificate_server.key from Certificate ID_Domain name bound to the certificate_Apache.
     • The Certificate ID_Domain name bound to the certificate_ca.crt file contains a segment of intermediate CA certificate code -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.
     • The Certificate ID_Domain name bound to the certificate_server.crt file contains a segment of server certificate code -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.
     • The Certificate ID_Domain name bound to the certificate_server.key file contains a segment of private key code -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY-----.
• Upload a CSR
  1. Decompress the downloaded certificate package to obtain the Certificate ID_Domain name bound to the certificate_server.pem file.

     The Certificate ID_Domain name bound to the certificate_server.pem file contains two segments of certificate codes -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----, which are the server certificate and intermediate CA certificate respectively.

  2. Copy the first segment of certificate code (server certificate) in the Certificate ID_Domain name bound to the certificate_server.pem file and save it as the server.crt file.
  3. Copy the second segment of certificate code (intermediate CA certificate) in the Certificate ID_Domain name bound to the certificate_server.pem file and save it as the ca.crt file.
  4. Place ca.crt, server.crt, and the server.key private key generated during CSR generation in any folder.

Step 2: Creating a Directory

Create a cert directory in the Apache installation directory, and copy the server.key, server.crt, and ca.crt files to the cert directory.

Step 3: Modifying Configuration Files

Before modifying the configuration file, back up the configuration file. You are advised to deploy the configuration file in the test environment and then configure it on the production environment to avoid service interruptions caused by incorrect configurations.

1. Open the conf.d/ssl.conf file in the Apache root directory.
2. Configure the domain name associated with the certificate.
   Find and modify the following parameter:

   ServerName www.example.com:443 

   The complete configuration is as follows (www.domain.com is used as an example):

   ServerName www.domain.com:443 #Replace www.domain.com with the domain name of your server.

3. Configure the public key for the certificate.

   Find and modify the following parameter:

   SSLCertificateFile "${SRVROOT}/conf/server.crt" 

   Set the value to the path of the server.crt file. The path cannot contain Chinese characters. An example of the path is cert/server.crt.

   The complete configuration is as follows:

   SSLCertificateFile "cert/server.crt"

4. Configure the private key for the certificate.

   Find and modify the following parameter:

   SSLCertificateKeyFile "${SRVROOT}/conf/server.key" 

   Set the value to the path of the server.key file. The path cannot contain Chinese characters. An example of the path is cert/server.key.

   The complete configuration is as follows:

   SSLCertificateKeyFile "cert/server.key"

5. Configure the certificate chain.

   Find and modify the following parameter:

   #SSLCertificateChainFile "${SRVROOT}/conf/server-ca.crt" 

   Delete the comment tag # at the beginning of the line. Set this parameter to the path of the ca.crt file. The path cannot contain Chinese characters. An example of the path is cert/ca.crt.

   The complete configuration is as follows:

   SSLCertificateChainFile "cert/ca.crt"

6. Save the ssl.conf file and exit.

Step 4: Restarting Apache

Restart the Apache service for the configuration to take effect:

1. Run the service named stop command to stop the Apache server.
2. Run the service httpd start command to start the Apache server.

Verifying the Result

After the deployment succeeds, in the address bar of the browser, enter https://Domain name and press Enter.

If a security padlock is displayed in the address bar of the browser, the certificate has been installed successfully.

• If the website still returns the warning tip, fix it by referring to Why Does the Browser Still Consider the Website Insecure While the Website Has an SSL Certificate Deployed?
• If the website cannot be accessed using the domain name, see Why Is My Website Inaccessible by Domain Name After an SSL Certificate Is Installed?