Step 1Place Certificate Files (Server Certificate) #

A typical placement example for Ubuntu (can be modified according to operational policy).

sudo mkdir -p /etc/ssl/private /etc/ssl/certs
sudo chmod 700 /etc/ssl/private

Save CA Console Certificate (PEM) to File #

Paste and save the certificate block from the text box in the CA console to /etc/ssl/certs/example.com.crt.

sudo nano /etc/ssl/certs/example.com.crt
sudo chmod 644 /etc/ssl/certs/example.com.crt

Example for automatic local save:

sudo tee /etc/ssl/certs/example.com.crt >/dev/null <<'EOF'
-----BEGIN CERTIFICATE-----
(paste certificate content here)
-----END CERTIFICATE-----
EOF
sudo chmod 644 /etc/ssl/certs/example.com.crt

Step 2Prepare Intermediate Certificate (CA Bundle / Intermediate) #

Most CAs provide an Intermediate Certificate (or CA Bundle) separately from the server certificate. Without this, some devices may display “untrusted” warnings.

Save Intermediate Certificate (Example) #

Save the intermediate certificate(s) obtained from the CA in PEM format to the following location.

sudo nano /etc/ssl/certs/intermediate-ca.pem
sudo chmod 644 /etc/ssl/certs/intermediate-ca.pem

When there are multiple intermediates #

If the CA Bundle contains multiple intermediate certificates, combine them into one file in the order specified by the CA (typically in ascending order toward the root).

Step 3Create the fullchain (server certificate + intermediate) #

For Apache, it is common practice to specify a fullchain (server certificate + intermediate) as the certificate file.

sudo cat /etc/ssl/certs/example.com.crt \
  /etc/ssl/certs/intermediate-ca.pem \
  | sudo tee /etc/ssl/certs/example.com.fullchain.pem >/dev/null

sudo chmod 644 /etc/ssl/certs/example.com.fullchain.pem

Step 4Verify that the private key and certificate match (important) #

If the certificate and private key do not match, HTTPS will not work properly even if you configure Apache. Be sure to verify this.

openssl x509 -noout -modulus -in /etc/ssl/certs/example.com.crt | openssl md5
openssl rsa  -noout -modulus -in /etc/ssl/private/example.com.key | openssl md5

# Certificate → Public key → SHA256
openssl x509 -in /etc/ssl/certs/example.com.crt -pubkey -noout \
  | openssl pkey -pubin -outform DER \
  | openssl sha256

# Private key → Public key → SHA256
openssl pkey -in /etc/ssl/private/example.com.key -pubout -outform DER \
  | openssl sha256

Step 5Enable HTTPS in Apache #

Enable required modules #

sudo a2enmod ssl
sudo a2enmod headers
sudo a2enmod rewrite
sudo systemctl reload apache2

Verify that port 443 is being listened on #

Typically, Listen 443 is included in /etc/apache2/ports.conf. Check as needed.

Step 6Apache VirtualHost configuration (443 + 80→443 redirect) #

As an example, we will create and deploy a site configuration file for example.com.

Create a site configuration file (example) #

sudo nano /etc/apache2/sites-available/example.com.conf

Configuration example (WordPress assumed) #

※ Replace example.com and DocumentRoot in the code with your actual environment.

<VirtualHost *:80>
    ServerName example.com

    # Permanent redirect from HTTP to HTTPS
    RewriteEngine On
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName example.com

    DocumentRoot /var/www/example.com/public

    # For WordPress (when using .htaccess)
    <Directory /var/www/example.com/public>
        AllowOverride All
        Require all granted
    </Directory>

    SSLEngine on

    # Specify fullchain (server certificate + intermediate)
    SSLCertificateFile      /etc/ssl/certs/example.com.fullchain.pem
    SSLCertificateKeyFile   /etc/ssl/private/example.com.key

    # Recommended: enable as needed (prioritize confirming operation first)
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    ErrorLog ${APACHE_LOG_DIR}/example.com-ssl-error.log
    CustomLog ${APACHE_LOG_DIR}/example.com-ssl-access.log combined
</VirtualHost>
</IfModule>

Enable the site #

sudo a2ensite example.com.conf

Test configuration → Reload #

sudo apache2ctl configtest
sudo systemctl reload apache2

To check which VirtualHosts are enabled:

sudo apache2ctl -S

Step 7Enable HTTPS in WordPress #

Step 8Verification #

curl -I https://example.com/
curl -I http://example.com/

echo | openssl s_client -connect example.com:443 -servername example.com -showcerts