Certificate Management Service:Install an SSL certificate on an Apache server (Linux)

Check whether port 443 is open

Run the following command to test port 443 connectivity. Replace <your_server_public_ip> with your server's public IP address.

RHEL/CentOS

command -v nc > /dev/null 2>&1 || sudo yum install -y nc
# Replace <your_server_public_ip> with the public IP address of your server.
sudo ss -tlnp | grep -q ':443 ' || sudo nc -l 443 & sleep 1; nc -w 3 -vz <your_server_public_ip> 443

Expected output if port 443 is open: Ncat: Connected to <your_server_public_ip>:443

Debian/Ubuntu

command -v nc > /dev/null 2>&1 || sudo apt-get install -y netcat
# Replace <your_server_public_ip> with the public IP address of your server.
sudo ss -tlnp | grep -q ':443 ' || sudo nc -l -p 443 & sleep 1; nc -w 3 -vz <your_server_public_ip> 443

Expected output if port 443 is open: Connection to <your_server_public_ip> port [tcp/https] succeeded! or [<your_server_public_ip>] 443 (https) open

If port 443 is not open, complete the following two sub-steps.

Open port 443 in your security group

Go to the Elastic Compute Service (ECS) instances page and click your instance name. In the Security Group Details section, add a security group rule with the following settings:

Open port 443 in your system firewall

Run the following command to identify your active firewall:

if command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
    echo "firewalld"
elif command -v ufw >/dev/null 2>&1 && sudo ufw status | grep -qw active; then
    echo "ufw"
elif command -v nft >/dev/null 2>&1 && sudo nft list ruleset 2>/dev/null | grep -q 'table'; then
    echo "nftables"
elif command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet iptables; then
    echo "iptables"
elif command -v iptables >/dev/null 2>&1 && sudo iptables -L 2>/dev/null | grep -qE 'REJECT|DROP|ACCEPT'; then
    echo "iptables"
else
    echo "none"
fi

If the output is none, no further action is needed. Otherwise, run the command that matches your firewall type:

firewalld

sudo firewall-cmd --permanent --add-port=443/tcp && sudo firewall-cmd --reload

ufw

sudo ufw allow 443/tcp

nftables

sudo nft add table inet filter 2>/dev/null
sudo nft add chain inet filter input '{ type filter hook input priority 0; }' 2>/dev/null
sudo nft add rule inet filter input tcp dport 443 counter accept 2>/dev/null

iptables

sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

To persist iptables rules across reboots:

*RHEL/CentOS*

sudo yum install -y iptables-services
sudo service iptables save

*Debian/Ubuntu*

sudo apt-get install -y iptables-persistent
sudo iptables-save | sudo tee /etc/iptables/rules.v4 >/dev/null

Check your Apache version and enable the SSL module

Step 3a: Check your Apache version

httpd -v

apache2 -v

Step 3b: Verify that the SSL module is enabled

httpd -M | grep 'ssl_module'

apachectl -M | grep 'ssl_module'

If the module is loaded, the output includes ssl_module (shared). If not, install it:

sudo yum install -y mod_ssl
# For RHEL/CentOS 8.0 and later:
sudo dnf install -y mod_ssl

sudo a2enmod ssl

Configure the VirtualHost

# Append the certificate chain to the server certificate to create a complete chain file.
cat domain_name_public.crt domain_name_chain.crt > domain_name_fullchain.pem

vim /etc/httpd/conf.d/ssl.conf

<VirtualHost *:443>

    # Replace example.com with the domain name you want to secure.
    ServerName example.com

    # Certificate file. Use the path to the combined fullchain file.
    SSLCertificateFile /etc/ssl/cert/domain_name_fullchain.pem

    # Private key file. Replace with the path to your private key file.
    SSLCertificateKeyFile /etc/ssl/cert/domain_name.key

    # Other configurations
    # ...

</VirtualHost>

vim /etc/httpd/conf.d/ssl.conf

<VirtualHost *:443>

    # Replace example.com with the domain name bound to your certificate.
    ServerName example.com

    # Certificate file. Replace with the path to your certificate file.
    SSLCertificateFile /etc/ssl/cert/domain_name_public.crt

    # Certificate chain file (specified separately). Replace with the actual path.
    SSLCertificateChainFile /etc/ssl/cert/domain_name_chain.crt

    # Private key file. Replace with the path to your private key file.
    SSLCertificateKeyFile /etc/ssl/cert/domain_name.key

    # Other configurations
    # ...

</VirtualHost>

Validate and reload Apache

Check the configuration syntax:

sudo httpd -t

sudo apache2ctl -t

If the output is Syntax OK, reload or restart Apache to apply the certificate:

# Reload (graceful, recommended):
sudo systemctl reload httpd

# Restart (force restart):
sudo systemctl restart httpd

# Reload (graceful, recommended):
sudo systemctl reload apache2

# Restart (force restart):
sudo systemctl restart apache2

HTTPS is inaccessible after installation — what should I check?

Work through the following checks in order:

1. Port 443 blocked: Confirm port 443 is open in both the security group and system firewall. See Step 2: Open port 443.

2. Domain mismatch: The domain you are accessing is not listed in the certificate's Bound Domains. See the domain coverage rules in Prerequisites.

3. Apache not reloaded: The Apache service was not reloaded or restarted after the configuration change. See Validate and reload Apache.

4. Incorrect certificate path or stale files: Verify that the paths in the Apache configuration file point to the correct, up-to-date certificate files.

5. Certificate missing on upstream services: If your domain routes through a Content Delivery Network (CDN), Server Load Balancer (SLB), or Web Application Firewall (WAF), install the certificate on those services too. See Certificate deployment locations when traffic passes through multiple Alibaba Cloud services.

6. Multi-server deployment incomplete: If the domain's DNS resolves to multiple servers, install the certificate on every server.

The browser shows "certificate name mismatch" or NET::ERR_CERT_COMMON_NAME_INVALID — what does this mean?

The domain you are accessing does not match any domain in the certificate's Bound Domains. Check the domain coverage rules in Prerequisites, then purchase or update your certificate if needed.

How do I update or replace an SSL certificate in Apache?

1. Back up old files: Save copies of the existing .crt and .key files on the server.

2. Download new files: Get the new certificate and private key from the SSL Certificate Management console.

3. Replace files: Upload the new files to the same paths specified in your Apache configuration, overwriting the old ones.

4. Reload Apache: Run sudo systemctl reload httpd (RHEL/CentOS) or sudo systemctl reload apache2 (Debian/Ubuntu) to apply the new certificate without downtime.