SSL Setup in Apache and HTTPS Redirection with .htaccess

Apache HTTP Server is still one of the most widely used web servers, and it provides SSL support through the mod_ssl module. In this guide, we'll go step by step through defining your certificate inside a VirtualHost and redirecting from HTTP to HTTPS with .htaccess.

Required files and module

Apache expects the certificate parts via separate directives:

• SSLCertificateFile → certificate.crt (server certificate)
• SSLCertificateKeyFile → private.key (private key)
• SSLCertificateChainFile → ca_bundle.crt (intermediate chain)

If you don't have these files, you can verify your domain with our free SSL wizard and download these three files (and the combined fullchain.pem if you want) from the ZIP package.

First, make sure the mod_ssl module is enabled:

sudo a2enmod ssl
sudo systemctl restart apache2

Step 1 — Place the files

sudo mkdir -p /etc/apache2/ssl/yourdomain.com
sudo cp certificate.crt /etc/apache2/ssl/yourdomain.com/
sudo cp private.key      /etc/apache2/ssl/yourdomain.com/
sudo cp ca_bundle.crt    /etc/apache2/ssl/yourdomain.com/
sudo chmod 600 /etc/apache2/ssl/yourdomain.com/private.key

Step 2 — Configure the VirtualHost

Define a virtual host for port 443 (e.g., /etc/apache2/sites-available/yourdomain-ssl.conf):

<VirtualHost *:443>
    ServerName yourdomain.com
    ServerAlias www.yourdomain.com
    DocumentRoot /var/www/yourdomain.com

    SSLEngine on
    SSLCertificateFile      /etc/apache2/ssl/yourdomain.com/certificate.crt
    SSLCertificateKeyFile   /etc/apache2/ssl/yourdomain.com/private.key
    SSLCertificateChainFile /etc/apache2/ssl/yourdomain.com/ca_bundle.crt

    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

    <Directory /var/www/yourdomain.com>
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

Note: In Apache 2.4.8 and later, instead of SSLCertificateChainFile, it is also valid to use a fullchain.pem that has the intermediate chain included directly in SSLCertificateFile.

Step 3 — Enable the site and test

sudo a2ensite yourdomain-ssl.conf
sudo apache2ctl configtest
sudo systemctl reload apache2

The configtest output should say Syntax OK. On RHEL/CentOS systems, the service name is httpd and the directory is /etc/httpd/.

Step 4 — HTTPS redirection with .htaccess

Add the following rule to the .htaccess file in your site's root directory. This permanently (301) moves all HTTP requests to HTTPS:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Verify from the terminal that the redirect is working:

curl -I http://yourdomain.com

In the response, you should see the 301 Moved Permanently and Location: https://... lines.

Common problems

• "AH02572: Failed to configure ... no private key": The SSLCertificateKeyFile path is wrong or the key is corrupt.
• Chain warning in the browser: SSLCertificateChainFile is not defined; add ca_bundle.crt.
• .htaccess is ignored: AllowOverride All must be defined in the relevant Directory block.

Summary

SSL in Apache comes down to having three directives (SSLCertificateFile, SSLCertificateKeyFile, SSLCertificateChainFile) point to the correct files and setting up a 301 redirect with .htaccess. You can generate your files with our free SSL wizard and download them from the ZIP.