Installing an SSL certificate on Apache

Enable the modules first, or the directives below are silently unknown.

a2enmod ssl headers http2 # Debian/Ubuntu

<VirtualHost *:443>
    ServerName example.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile    /etc/ssl/certs/fullchain.pem
    SSLCertificateKeyFile /etc/ssl/private/example.com.key

    Protocols h2 http/1.1
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    Header always set Strict-Transport-Security "max-age=63072000"
</VirtualHost>

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

apachectl configtest && systemctl reload apache2

SSLCertificateChainFile has been deprecated since 2.4.8. Append the intermediates to the file named by SSLCertificateFile instead — same fullchain as nginx. If you inherited a config that still uses it, it works but will warn.

Verify it from the outside

A config that reloads without error can still be serving the wrong file, and your own browser will hide a missing intermediate because it caches them from other sites. Check what Apache httpd 2.4 actually presents:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

Or use the Domain SSL Checker, which performs the same handshake from this server and flags an incomplete chain explicitly.

Installing an SSL certificate on Apache

Verify it from the outside

Other platforms