Certificate Management Service:Install SSL certificates on Apache servers

Step 2: Install the certificate on the Apache server

1. Run the following commands to create a directory named cert in the installation directory of Apache.

   1. Run the following command to go to the installation directory of Apache:

      cd /etc/httpd/ # Go to the default installation directory of Apache that is installed by using yum. If you have changed the directory or installed Apache by using other methods, specify the actual directory.

   2. Run the following command to create a directory named cert:

      mkdir cert # Create a directory named cert.

2. Upload the certificate file and password file to the certificate directory (/etc/httpd/cert) of the Apache server.

   Note

   You can upload the file by using the file upload feature of a remote logon tool, such as PuTTY, Xshell, and WinSCP. For more information about how to upload a file to an Alibaba Cloud Elastic Compute Service (ECS) instance, see Upload files to or download files from a Windows instance or Upload a file to a Linux instance.

3. Modify the certificate-related settings in the httpd.conf and ssl.conf configuration files.

   1. Find the LoadModule ssl_module modules/mod_ssl.so parameter that is used to load the mod_ssl.so module and enable SSL encryption, and find the Include conf.modules.d/*.conf parameter that is used to load the SSL configuration directory. Check whether comments that start with the number sign (#) are added to the parameters. If yes, remove the comments.

      Important

      The configuration files that contain the parameters vary based on the operating system and the installation method of Apache. The following list describes the configuration files that contain the parameters:

      • conf.modules.d/00-ssl.conf: This file contains the LoadModule ssl_module modules/mod_ssl.so parameter.

      • httpd.conf: This file contains the Include conf.modules.d/*.conf parameter.

      • http-ssl.conf

      If you cannot find the preceding parameters, check whether the mod_ssl.so module is installed on the Apache server. If the module is not installed, you can run the yum install -y mod_ssl command to install the module. After you run the command, you can run the httpd -M | grep 'ssl' command to check whether the mod_ssl.so module is successfully installed on the Apache server.

   2. Run the following command to open the ssl.conf configuration file:

      vim /etc/httpd/conf.d/ssl.conf

      Important

      The name of the configuration file and the directory in which the configuration file is stored vary based on your operating system. If you cannot find the ssl.conf file, check whether the conf/extra/http-ssl.conf configuration file exists in the installation directory of Apache.

   3. Find the following parameters in the ssl.conf configuration file and configure the parameters based on the following comments:

      <VirtualHost *:443> 
       ServerName example.com # Set ServerName to the domain name that you add to the certificate.  
       SSLCertificateFile cert/domain_name_public.crt # Replace domain_name_public.crt with the name of your certificate file. 
       SSLCertificateKeyFile cert/domain_name.key # Replace domain_name.key with the name of your private key file. 
       SSLCertificateChainFile cert/domain_name_chain.crt # Replace domain_name_chain.crt with the name of your certificate chain file. If the name starts with a number sign (#), delete the number sign. 
       
       # Specify the Transport Layer Security (TLS) protocols and custom cipher suites that you want to use. The following sample code is only for reference.
       # A later TLS version offers higher security but lower compatibility with browsers. 
       #SSLProtocol all -SSLv2 -SSLv3 # Add supported SSL protocols and remove the protocols that are not secure. 
       #SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM # Modify the cipher suite. 
      </VirtualHost>
      
      # If your certificate contains multiple domain names, copy the VirtualHost parameter, and set ServerName to a different domain name.  
      <VirtualHost *:443> 
       ServerName example2.com# Set ServerName to a different domain name that you add to the certificate.  
       SSLCertificateFile cert/domain_name2_public.crt # Replace domain_name2 with the different domain name. 
       SSLCertificateKeyFile cert/domain_name2.key # Replace domain_name2 with the different domain name. 
       SSLCertificateChainFile cert/domain_name2_chain.crt # Replace domain_name2 with the different domain name. If the name starts with a number sign (#), delete the number sign. 
       
       SSLEngine on 
       SSLHonorCipherOrder on
       # Specify the TLS protocols and custom cipher suites that you want to use. The following sample code is only for reference.
       # A later TLS version offers higher security but lower compatibility with browsers. 
       #SSLProtocol all -SSLv2 -SSLv3 # Add supported SSL protocols and remove the protocols that are not secure. 
       #SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM # Modify the cipher suite. 
      </VirtualHost>

      Important

      Check whether your browser version supports server name indication (SNI). If your browser version does not support SNI, the configuration of a multi-domain certificate does not take effect.

   4. Optional. Modify the httpd.conf configuration file to configure automatic redirection of HTTP requests to HTTPS requests.

      Add the following redirection code to the httpd.conf configuration file:

      RewriteEngine on
      RewriteCond %{SERVER_PORT} !^443$
      RewriteRule ^(.*)$ https://%{SERVER_NAME}$1 [L,R]

4. Restart the Apache service to make the preceding configuration take effect.

   1. Run the apachectl -k stop command to stop the Apache service.

   2. Run the apachectl -k start command to start the Apache service.

https://yourdomain   # Replace yourdomain with the domain name that is bound to your certificate.