How to install an SSL certificate on a server with nginx or Apache

Files you need

privkey.pem and fullchain.pem.

Upload the certificate from production mode. A certificate from test mode is only for checking the process: browsers don't trust it, and some panels won't accept it at all.

Step by step

1. Copy both files to the server. On Windows, the easiest way is the WinSCP program. From a terminal, use this command:

   scp privkey.pem fullchain.pem user@yourserver:~

2. On the server, move the files to a separate folder and protect the private key:

   sudo mkdir -p /etc/ssl/yourdomain
   sudo mv ~/privkey.pem ~/fullchain.pem /etc/ssl/yourdomain/
   sudo chown root:root /etc/ssl/yourdomain/*.pem
   sudo chmod 600 /etc/ssl/yourdomain/privkey.pem

   On AlmaLinux, Rocky Linux and other systems with SELinux, also run sudo restorecon -Rv /etc/ssl/yourdomain. Without it, the web server may not be able to read the moved files.
3. nginx: in the server block for your domain, add:

   listen 443 ssl;
   ssl_certificate     /etc/ssl/yourdomain/fullchain.pem;
   ssl_certificate_key /etc/ssl/yourdomain/privkey.pem;

   If the block contains the line listen [::]:80;, also add listen [::]:443 ssl;. Check the configuration with sudo nginx -t and reload the server: sudo systemctl reload nginx.
4. Apache: first turn on the SSL module. On Debian and Ubuntu: sudo a2enmod ssl, then sudo systemctl restart apache2. On AlmaLinux and Rocky Linux, install it: sudo dnf install mod_ssl. In the <VirtualHost *:443> block for your domain, add:

   SSLEngine on
   SSLCertificateFile    /etc/ssl/yourdomain/fullchain.pem
   SSLCertificateKeyFile /etc/ssl/yourdomain/privkey.pem

   If there is no such block, copy the <VirtualHost *:80> block for this domain, change 80 to 443 in the copy and add these three lines. If the block already has an SSLCertificateChainFile line, remove it. Check the configuration with sudo apachectl configtest, then reload the server: sudo systemctl reload apache2 (on AlmaLinux and Rocky Linux: sudo systemctl reload httpd).

Checking the result

Open your website over https:// and click the padlock (or the settings icon) next to the address. The certificate details should show Let's Encrypt as the issuer and an expiry date matching the panel. If the browser still shows the old certificate, wait a few minutes and reload the page.

If you see a warning instead of your website, we explain the error codes on the page “Your connection is not private”. If the site opens over https but looks broken or something doesn't work, see mixed content. Finally, turn on the redirect from http to https so everyone lands on the secure version.

Good to know

• Port 443 must be open in the server's firewall and in your provider's firewall, if it has one. On Ubuntu with ufw: sudo ufw allow 443/tcp. On AlmaLinux and Rocky Linux: sudo firewall-cmd --permanent --add-service=https, then sudo firewall-cmd --reload.
• Apache older than 2.4.8 does not accept the chain in SSLCertificateFile. In that case, SSLCertificateFile points to cert.pem and an extra SSLCertificateChainFile line points to chain.pem. You can check the version with apachectl -v.

When you renew

Upload the new files the same way as the first time: steps 1 and 2, including the chown and chmod commands (and restorecon on systems with SELinux), because new files come with their own permissions. Then reload the web server (the reload command from step 3 or 4). You do not need to change the configuration.

Hosting panels change from time to time. If something looks different from this guide, write to kontakt@freessl.pl and we'll update it.