RymarisCerts APACHE recorded installation walkthrough This is a genuine scripted terminal/PowerShell session on an isolated demo server. All displayed operations were executed. No production certificates, passwords, MFA, or private-key contents are included. Lab .test hostnames and explicit-root checks must be replaced with your own hostnames and normal public trust in production. Passwords were supplied privately before recording. On your server enter package passwords locally;never put them into commands,source files,or website configuration. 00:00:00.000 Chapter 1: Confirm the server and scope 00:00:09.022 Chapter 2: Choose and protect the PEM ZIP 00:00:23.030 Chapter 3: Prepare a restricted server key 00:00:45.051 Chapter 4: Update only the intended TLS site 00:01:02.148 Chapter 5: Verify HTTPS and the control site 00:01:22.186 Chapter 6: Install a renewed certificate 00:01:53.314 Chapter 7: Prove rollback remains available 00:02:09.417 Chapter 8: Restore renewal and finish verification RECORDED COMMANDS AND OUTPUT RymarisCerts | apache certificate installation CHAPTER 1 | Confirm the server and scope Recorded on a prepared Ubuntu lab;commands below run on the real server. Disposable .test certificates are NOT publicly trusted. No passwords,private-key contents or MFA are recorded. $ apachectl -v Server version: Apache/2.4.58 (Ubuntu) Server built: 2026-11-12T12:58:56 RymarisCerts | apache certificate installation CHAPTER 2 | Choose and protect the PEM ZIP $ printf "Package folder: %s\n" "$PKG" Package folder: /opt/rymariscerts-demo/packages/apache/initial $ unzip -l "$base/packages/$server/initial.zip" Archive: /opt/rymariscerts-demo/packages/apache/initial.zip Length Date Time Name --------- ---------- ----- ---- 1619 2026-11-13 15:49 certificate.pem 3185 2026-11-13 15:49 fullchain.pem 2654 2026-11-13 15:49 private-key.encrypted.pem 94 2026-11-13 15:49 README.txt --------- ------- 7552 4 files Use certificate.pem,fullchain.pem,and private-key.encrypted.pem. The package password was supplied privately before recording. Never place keys in the public website directory. RymarisCerts | apache certificate installation CHAPTER 3 | Prepare a restricted server key $ umask 077 $ mkdir -p "$DEST" $ openssl pkey -in "$PKG/private-key.encrypted.pem" -passin env:RYMARIS_INITIAL_PACKAGE_PASSWORD -out "$DEST/private-key.pem" $ install -m 644 "$PKG/fullchain.pem" "$DEST/fullchain.pem" $ stat -c "%U %a %n" "$DEST/private-key.pem" root 600 /etc/rymariscerts-demo/apache/video-take-20261113-160725/initial/private-key.pem The passphrase variable is temporary and is not shown or saved in configuration. RymarisCerts | apache certificate installation CHAPTER 4 | Update only the intended TLS site $ cp -p "$SITE" "$take/$server-original-site.conf" $ sed -i -E "s@SSLCertificateFile .*@SSLCertificateFile $DEST/fullchain.pem@;s@SSLCertificateKeyFile .*@SSLCertificateKeyFile $DEST/private-key.pem@" "$SITE" $ cat "$SITE" ServerName apache.rymariscerts.test DocumentRoot /var/www/rymariscerts-demo/apache/target SSLEngine on SSLCertificateFile /etc/rymariscerts-demo/apache/video-take-20261113-160725/initial/fullchain.pem SSLCertificateKeyFile /etc/rymariscerts-demo/apache/video-take-20261113-160725/initial/private-key.pem $ apachectl configtest && systemctl reload apache2 Syntax OK RymarisCerts | apache certificate installation CHAPTER 5 | Verify HTTPS and the control site $ curl --fail --cacert "$CA" --resolve "$HOST:$port:127.0.0.1" "https://$HOST:$port/" RymarisCerts apache HTTPS demo

RymarisCerts apache HTTPS demo

Disposable lab certificates only.

$ printf "\n" | openssl s_client -connect "127.0.0.1:$port" -servername "$HOST" -CAfile "$CA" -verify_return_error 2>/dev/null | openssl x509 -noout -subject -enddate -fingerprint -sha256 subject=CN = apache.rymariscerts.test notAfter=Dec 13 15:49:52 2026 GMT sha256 Fingerprint=7A:BB:BC:57:5C:BC:A1:62:3E:8D:3F:1C:A6:5D:72:A7:99:4D:7E:39:BC:A5:30:79:73:84:88:65:E3:18:B5:61 $ curl --fail --resolve "control.$server.rymariscerts.test:$control:127.0.0.1" "http://control.$server.rymariscerts.test:$control/" RymarisCerts apache control

RymarisCerts apache control site

$ cp -p "$SITE" "$BACKUP" --cacert and --resolve are lab-only here. For production,verify public DNS and normal browser trust from another device. RymarisCerts | apache certificate installation CHAPTER 6 | Install a renewed certificate $ printf "Renewal package: %s\n" "$PKG" Renewal package: /opt/rymariscerts-demo/packages/apache/renewed $ mkdir -p "$DEST" $ openssl pkey -in "$PKG/private-key.encrypted.pem" -passin env:RYMARIS_RENEWED_PACKAGE_PASSWORD -out "$DEST/private-key.pem" $ install -m 644 "$PKG/fullchain.pem" "$DEST/fullchain.pem" $ sed -i -E "s@SSLCertificateFile .*@SSLCertificateFile $DEST/fullchain.pem@;s@SSLCertificateKeyFile .*@SSLCertificateKeyFile $DEST/private-key.pem@" "$SITE" $ apachectl configtest && systemctl reload apache2 Syntax OK $ printf "\n" | openssl s_client -connect "127.0.0.1:$port" -servername "$HOST" -CAfile "$CA" -verify_return_error 2>/dev/null | openssl x509 -noout -enddate -fingerprint -sha256 notAfter=Jan 12 15:49:53 2027 GMT sha256 Fingerprint=7E:B3:2C:BB:06:39:20:1F:20:92:B5:70:63:C5:C7:F5:F5:87:D8:D2:F2:52:AC:D6:04:11:F6:EC:D6:4F:FA:D5 $ cp -p "$SITE" "$RENEWED" The renewal has a later expiry and a different served fingerprint. A fresh package password was supplied privately. RymarisCerts | apache certificate installation CHAPTER 7 | Prove rollback remains available $ cp -p "$BACKUP" "$SITE" $ apachectl configtest && systemctl reload apache2 Syntax OK $ printf "\n" | openssl s_client -connect "127.0.0.1:$port" -servername "$HOST" -CAfile "$CA" -verify_return_error 2>/dev/null | openssl x509 -noout -enddate -fingerprint -sha256 notAfter=Dec 13 15:49:52 2026 GMT sha256 Fingerprint=7A:BB:BC:57:5C:BC:A1:62:3E:8D:3F:1C:A6:5D:72:A7:99:4D:7E:39:BC:A5:30:79:73:84:88:65:E3:18:B5:61 Rollback restored the initial certificate. Keep the old protected package until installation and external checks pass. RymarisCerts | apache certificate installation CHAPTER 8 | Restore renewal and finish verification $ cp -p "$RENEWED" "$SITE" $ apachectl configtest && systemctl reload apache2 Syntax OK $ curl --fail --cacert "$CA" --resolve "$HOST:$port:127.0.0.1" "https://$HOST:$port/" RymarisCerts apache HTTPS demo

RymarisCerts apache HTTPS demo

Disposable lab certificates only.

$ curl --fail --resolve "control.$server.rymariscerts.test:$control:127.0.0.1" "http://control.$server.rymariscerts.test:$control/" RymarisCerts apache control

RymarisCerts apache control site

Renewed certificate active;control site still responds. Downloading a renewal alone does not install it. Repeat validation for every real hostname and server. PASSWORD INPUT NOTE The two passphrase environment variables in this recorded automation were supplied privately and removed afterward. For an interactive install,omit -passin and enter the package password at the OpenSSL prompt. Use a fresh password for each package.