SSL Certificates with Apache on Debian & Ubuntu

Select distribution:
Traducciones al Español
Estamos traduciendo nuestros guías y tutoriales al Español. Es posible que usted esté viendo una traducción generada automáticamente. Estamos trabajando con traductores profesionales para verificar las traducciones de nuestro sitio web. Este proyecto es un trabajo en curso.
Create a Linode account to try this guide with a $100 credit.
This credit will be applied to any valid services used during your first 60 days.

This guide will show you how to enable SSL to secure websites served through Apache on Debian and Ubuntu.

Before You Begin

This guide assumes that you are running Apache 2.4 or higher on Debian 8 or Ubuntu 14.04 or above. Prior to following this guide, ensure that the following steps have been taken on your Linode:

  • Familiarize yourself with our Getting Started guide and complete the steps for setting your Linode’s hostname and timezone.

  • Complete our Hosting a Website guide, and create a site that you wish to secure with SSL.

  • Follow our guide to obtain either a self-signed or commercial SSL certificate.

  • If hosting multiple websites with commercial SSL certificates on the same IP address, use the Server Name Identification (SNI) extension of TLS. SNI is accepted by most modern web browsers. If you expect to receive connections from clients running legacy browsers (like Internet Explorer for Windows XP), you will need to contact support to request an additional IP address.

Configure Apache to use the SSL Certificate

  1. Edit the virtual host configuration files located in /etc/apache2/sites-available to provide the certificate file paths. For each virtual host, replicate the configuration shown below. Replace each mention of example.com with your own domain. You will also need to ensure that the SSLCACertificateFile value is configured to point to the ca-certificates.crt file updated in the previous step:

    File: /etc/apache2/sites-available/example.com.conf
     1
     2
     3
     4
     5
     6
     7
     8
     9
    10
    11
    12
    13
    
    <VirtualHost *:443>
        SSLEngine On
        SSLCertificateFile /etc/ssl/certs/example.com.crt
        SSLCertificateKeyFile /etc/ssl/private/example.com.key
        SSLCACertificateFile /etc/ssl/certs/ca-certificates.crt  #If using a self-signed certificate, omit this line
    
        ServerAdmin info@example.com
        ServerName www.example.com
        ServerAlias www.example2.com #If using alternate names for a host
          DocumentRoot /var/www/html/example.com/public_html/
        ErrorLog /var/www/html/example.com/log/error.log
        CustomLog /var/www/html/example.com/log/access.log combined
    </VirtualHost>
  2. Ensure that the Apache SSL module is enabled, and enable the virtualhost configuration:

    a2enmod ssl
    a2ensite example.com
    
  3. Restart Apache:

    service apache2 restart
    
  4. If troubleshooting issues, a system reboot may be required.

Test Your Configuration

After configuration, some browsers may display the site correctly although errors still exist. Test your SSL configuration using the test page at your certificate issuer’s website, then perform the following steps.

  1. Check for errors using openssl s_client:

    openssl s_client -CApath /etc/ssl/certs/ -connect example.com:443
    
  2. Perform a deep analysis through the Qualys SSL Labs SSL Server Test

You should now be able to visit your site with SSL enabled.

More Information

You may wish to consult the following resources for additional information on this topic. While these are provided in the hope that they will be useful, please note that we cannot vouch for the accuracy or timeliness of externally hosted materials.

This page was originally published on


Your Feedback Is Important

Let us know if this guide made it easy to get the answer you needed.


Join the conversation.
Read other comments or post your own below. Comments must be respectful, constructive, and relevant to the topic of the guide. Do not post external links or advertisements. Before posting, consider if your comment would be better addressed by contacting our Support team or asking on our Community Site.