Every single website I launch these days gets HTTPS from day one — there’s really no excuse not to anymore, especially with free certificates readily available. In this guide, I’ll walk through exactly how I set up SSL/TLS on Apache using Let’s Encrypt, and cover the manual certificate installation process too for cases where you’re using a paid certificate authority.
Why HTTPS Is Non-Negotiable Today
- Data encryption — protects everything passed between your visitors and your server, from login credentials to payment information.
- Browser trust indicators — modern browsers actively flag HTTP sites as “Not Secure.”
- SEO benefit — Google has confirmed HTTPS is a ranking signal.
- Required for modern web features — HTTP/2, service workers, and many browser APIs require a secure context.
Prerequisites
- A registered domain name pointing to your server’s IP address
- Root or sudo access to the server
- Apache 2.4+ installed
- Port 80 and 443 open in your firewall
mod_sslavailable (I’ll show you how to enable it)
Step 1: Enable mod_ssl
On Debian/Ubuntu:
sudo a2enmod ssl
sudo systemctl restart apache2
On CentOS/RHEL:
sudo yum install mod_ssl
sudo systemctl restart httpd
Step 2: Get a Free Certificate With Let’s Encrypt (Certbot)
This is my default approach for the vast majority of sites I set up. Certbot automates both certificate issuance and renewal.
Install Certbot:
sudo apt install certbot python3-certbot-apache # Debian/Ubuntu
sudo yum install certbot python3-certbot-apache # CentOS/RHEL
Run Certbot with the Apache plugin, which automatically detects your virtual hosts and configures SSL for you:
sudo certbot --apache -d example.com -d www.example.com
Certbot will ask a few questions — I always choose the option to redirect all HTTP traffic to HTTPS automatically when prompted.
Step 3: Verify Auto-Renewal Is Set Up
Let’s Encrypt certificates expire every 90 days, so renewal automation is essential. Certbot installs a systemd timer or cron job automatically, but I always confirm it:
sudo systemctl list-timers | grep certbot
I also test the renewal process manually to make sure it works before I need it:
sudo certbot renew --dry-run
Step 4: Manually Configuring SSL (For Paid/Commercial Certificates)
If you’re using a certificate from a commercial CA (say, for a business that requires Extended Validation), the process is slightly more manual. First, generate a Certificate Signing Request (CSR):
openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr
You’ll submit the CSR to your certificate authority, and they’ll issue you a certificate file (and usually an intermediate bundle). Once you have those files, configure your virtual host:
<VirtualHost *:443>
ServerName example.com
DocumentRoot /var/www/example.com
SSLEngine on
SSLCertificateFile /etc/ssl/certs/example.com.crt
SSLCertificateKeyFile /etc/ssl/private/example.com.key
SSLCertificateChainFile /etc/ssl/certs/example.com.chain.crt
</VirtualHost>
Step 5: Redirect HTTP to HTTPS
Whether you used Certbot’s automatic option or configured SSL manually, make sure plain HTTP traffic is redirected:
<VirtualHost *:80>
ServerName example.com
Redirect permanent / https://example.com/
</VirtualHost>
Step 6: Harden Your SSL/TLS Configuration
Getting a certificate installed is only half the job — I always tighten the actual TLS configuration too, since outdated protocols and ciphers remain a real risk:
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder on
SSLCompression off
SSLSessionTickets off
This disables the older, insecure TLS 1.0 and 1.1 protocols and restricts cipher suites to strong, modern options.
Step 7: Test Your Configuration
I always test syntax before restarting:
sudo apachectl configtest
sudo systemctl restart apache2
Then I run the domain through SSL Labs’ SSL Server Test to check for any misconfigurations and confirm the grade — I aim for an A or A+ on every client site.
Real-World Use Case
For a small business client migrating from an old shared host to a VPS, I set up Certbot with the Apache plugin, which handled both certificate issuance and the virtual host SSL configuration automatically in under five minutes. Combined with the TLS hardening above, their SSL Labs score went straight to an A.
Common Mistakes to Avoid
- Forgetting to open port 443 in the firewall, which causes HTTPS connections to silently fail.
- Leaving old TLS 1.0/1.1 enabled, which fails modern security audits and PCI compliance checks.
- Not testing certificate renewal, leading to expired certificates and site outages.
- Mixing HTTP and HTTPS content on the same page (mixed content warnings), which breaks the padlock indicator even with a valid certificate.
Troubleshooting Tips
If Certbot fails with a “connection refused” or validation error, confirm your domain’s DNS actually points to the server and that port 80 is open, since Let’s Encrypt’s HTTP validation method requires it. If Apache fails to start after adding SSL configuration, check the error log:
sudo tail -f /var/log/apache2/error.log
Common culprits are incorrect file paths for the certificate or key, or a missing intermediate certificate chain.
Security and Performance Best Practices
- Enable HTTP/2 alongside SSL for better performance (
Protocols h2 http/1.1). - Pair SSL with HSTS to prevent SSL-stripping attacks.
- Use OCSP stapling to speed up certificate validation:
SSLUseStapling on
SSLStaplingCache "shmcb:/var/run/ocsp(128000)"
- Set a calendar reminder to check on commercial certificate renewals well before expiry, since those aren’t automated like Let’s Encrypt.
Frequently Asked Questions
Is a free Let’s Encrypt certificate as secure as a paid one? Yes, in terms of encryption strength they’re identical. Paid certificates sometimes offer extended validation branding or warranty guarantees, but the underlying encryption is the same.
How often do I need to renew my SSL certificate? Let’s Encrypt certificates last 90 days and should auto-renew. Commercial certificates typically last 1-2 years and require manual renewal unless you set up automation.
Can I use SSL on a site with multiple subdomains? Yes — either request a wildcard certificate (covers all subdomains) or list each subdomain explicitly using the -d flag with Certbot.
Why does my site still show “Not Secure” after installing SSL? This usually means mixed content — some resources on the page (images, scripts) are still being loaded over HTTP. Check your browser console for mixed content warnings.
Summary and Key Takeaways
Setting up HTTPS on Apache is quick with Certbot for most sites, and only slightly more involved for commercial certificates. The certificate itself is just step one — hardening your TLS protocol and cipher configuration, redirecting HTTP to HTTPS, and setting up reliable renewal are equally important for a genuinely secure setup.