Self-service installation

Apache HTTP Server 2.4

Choose: Apache / Nginx — PEM ZIP with encrypted private key

Prefer automatic replacement? Set up automatic renewal for supported Apache HTTP Server 2.4 configurations. These written steps and videos remain the manual-installation fallback.

Before you start

• Confirm you administer this server and can restore its current configuration.
• Check the certificate is production-issued, unexpired and covers every intended hostname.
• Check DNS points to the intended server, including any IPv6, proxy or CDN path. A certificate does not change DNS.
• Download the matching package; store it outside the web root and keep its password separately.

These examples target a conventional Linux server with OpenSSL and an existing Apache HTTP Server 2.4 installation. Use administrator access, your distribution's service names and the required TLS module/listener. A hosting panel may require a different workflow.

Watch a recorded installation

Recorded scripted terminal session on an isolated demo server. Every displayed operation was executed. Silent, with English captions. Pause or use full screen to read commands. Disposable .test certificates are not publicly trusted; use your own hostnames and normal public trust in production. Passwords and MFA are supplied privately and are not shown.

Read the recorded transcript · Watch the quick slide overview

Jump to a chapter

1. 00:00 Confirm the server and scope
2. 00:09 Choose and protect the PEM ZIP
3. 00:23 Prepare a restricted server key
4. 00:45 Update only the intended TLS site
5. 01:02 Verify HTTPS and the control site
6. 01:22 Install a renewed certificate
7. 01:53 Prove rollback remains available
8. 02:09 Restore renewal and finish verification

Chapters are ready when video metadata loads.

Install step by step

1. Download the production PEM ZIP with fresh MFA and a new package password. Back up the existing virtual host configuration. Transfer and extract the ZIP in a restricted directory outside your document root.

2. Use fullchain.pem for the certificate chain. The supplied private-key.encrypted.pem is encrypted. Enter the package password locally when preparing the server key; never paste it into a command, chat, source repository or website configuration.

3. Prepare the server key in a directory accessible only to the administrator and required service identity. For a conventional root-started Linux service, use a root-owned directory mode 700 and key mode 600. A local OpenSSL conversion can produce a restricted server key; that resulting file is unencrypted and must remain protected. Preserve your encrypted recovery package.

4. In the intended TLS virtual host, enable TLS and point SSLCertificateFile to fullchain.pem and SSLCertificateKeyFile to the protected server key. Keep the existing document root, hostname and other sites intact. The ssl module and port 443 listener must already be configured for your distribution.

5. Run apachectl configtest and resolve any errors before reloading the appropriate service (apache2 or httpd, depending on the distribution). Keep a rollback path; do not replace the whole server configuration with the example below.

6. Check every HTTPS hostname from another device, including browser trust, SAN coverage, expiry and fingerprint. Repeat the installation for each renewal. The example is for a conventional Linux installation; managed hosting and encrypted-key startup helpers may require different steps.

Illustrative configuration

Use your own paths and hostnames. Preserve the rest of your existing configuration.

# Run locally as an authorized administrator; enter the password at the prompt.
# Create a restricted directory first and keep the output key root-owned/mode 600.
umask 077
openssl pkey -in private-key.encrypted.pem -out private-key.pem

# Inside the existing intended TLS virtual host:
SSLEngine on
SSLCertificateFile /etc/rymariscerts/example.com/fullchain.pem
SSLCertificateKeyFile /etc/rymariscerts/example.com/private-key.pem

apachectl configtest
# Reload only after the check passes, using your distribution's service name.

Verify before calling it done

• Use another device to open every intended HTTPS hostname without bypassing certificate warnings.
• Check the correct website loads and the served certificate has the expected names, expiry and SHA-256 fingerprint.
• Check apex and www independently. A wildcard does not automatically include the apex.
• Confirm unrelated sites still work. Keep rollback material protected until checks pass.

Troubleshooting

Replacing an expiring certificate? Use the renewal checklist. Need assistance? Request a separate quote.

Official references

• https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html
• https://httpd.apache.org/docs/2.4/mod/mod_ssl.html
• https://docs.openssl.org/master/man1/openssl-pkey/

All installation guides · Your certificates