How to Enable SSL (HTTPS) for Apache With Certbot or Your Own Certificate

Updated: 30 September 2026 · Applies to: Apache 2.4 with mod_ssl and Certbot on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

Serving a website over HTTPS needs two things: Apache's SSL module and a certificate. The simplest way to get a trusted certificate is Let's Encrypt with Certbot, which also renews it automatically. The older way of creating a self-signed certificate by hand makes every browser show a warning, so use it only for internal testing.

Before you start

• The domain's DNS A (and AAAA) record points to the server.
• Port 80 and 443 are open. Certbot proves you control the domain over port 80.
• The site already works over HTTP with its own <VirtualHost *:80> and ServerName.

1. Install the SSL module and Certbot

# AlmaLinux, Rocky Linux, RHEL
dnf install mod_ssl
dnf install epel-release
dnf install certbot python3-certbot-apache
systemctl restart httpd

# Ubuntu, Debian
a2enmod ssl
apt install certbot python3-certbot-apache
systemctl restart apache2

2. Open the firewall

firewall-cmd --permanent --add-service=http --add-service=https && firewall-cmd --reload   # firewalld
ufw allow 'Apache Full'                                                                   # UFW on Ubuntu

3. Get the certificate

certbot --apache -d example.com -d www.example.com

Certbot finds the matching virtual host, gets the certificate, creates an HTTPS virtual host (<VirtualHost *:443>) with the certificate paths, and can redirect HTTP to HTTPS for you. The certificate files are in /etc/letsencrypt/live/example.com/.

4. Check renewal

certbot renew --dry-run
systemctl list-timers | grep certbot

Let's Encrypt certificates are valid for 90 days; the Certbot package installs a timer that renews them automatically before they expire.

5. Test

curl -I https://example.com
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Using a certificate you bought

Put the certificate, the intermediate chain and the private key on the server, and point the HTTPS virtual host to them:

<VirtualHost *:443>
    ServerName example.com
    DocumentRoot /var/www/example.com/public
    SSLEngine on
    SSLCertificateFile    /etc/pki/tls/certs/example.com-fullchain.pem
    SSLCertificateKeyFile /etc/pki/tls/private/example.com.key
</VirtualHost>

SSLCertificateFile should contain your certificate followed by the intermediate certificates. Keep the key readable only by root (chmod 600). Check with apachectl configtest, then reload Apache.

On cPanel servers, use AutoSSL in WHM instead; cPanel manages the certificates and virtual hosts itself.

Official documentation: Apache SSL/TLS how-to and Certbot user guide.