How to install SSL certificate on Apache?

This guide explains how to install an SSL certificate issued through ClouDNS on an Apache web server. The instructions cover Actalis, RapidSSL, and Sectigo certificates, including the intermediate certificates required to serve a complete certificate chain.

Step 1: Download the SSL certificate and certificate chain

Download your SSL certificate from the ClouDNS web panel. The certificate file will typically be named:

your-domain.com.crt

Apache must also serve the correct intermediate certificate chain. Select the Certificate Authority (CA) that issued your SSL certificate to view its download and installation instructions.

Before you begin

Check the Issuer of your domain certificate and use the corresponding CA section below. The required chain can vary even between certificates issued by the same provider.
Actalis certificates

For Actalis Domain Validated (DV) SSL certificates issued through the 2025 RSA hierarchy, download both the intermediate certificate and the cross-certificate from the official Actalis Legal Repository.

CertificateDownload
Actalis Domain Validated TLS Server RSA CA 2025
Intermediate certificate		 Download from Actalis
Actalis Crosscert TLS RSA Root CA 2025
Cross-certificate		 Download from Actalis

For the examples below, the two downloaded files are named:

actalis_dv_tls_rsa_2025.pem
actalis-crosscert-tls-rsa-2025-v3.crt
Important: These files apply to certificates issued by Actalis Domain Validated TLS Server RSA CA 2025. Certificates issued through another Actalis hierarchy, including ECC, OV or EV, may require different intermediate certificates.

The cross-certificate links Actalis TLS Server RSA Root CA 2025 to Actalis Authentication Root CA. It can provide an alternative trust path for systems that trust the older Actalis root.

Combine the three certificates in the following order:

OrderFilePurpose
1 your-domain.com.crt Domain certificate
2 actalis_dv_tls_rsa_2025.pem Intermediate CA
3 actalis-crosscert-tls-rsa-2025-v3.crt Cross-certificate

Linux:

(cat your-domain.com.crt; printf '\n'; cat actalis_dv_tls_rsa_2025.pem; printf '\n'; cat actalis-crosscert-tls-rsa-2025-v3.crt) > your-domain.com.fullchain.pem

Windows (Command Prompt):

(type your-domain.com.crt & echo. & type actalis_dv_tls_rsa_2025.pem & echo. & type actalis-crosscert-tls-rsa-2025-v3.crt) > your-domain.com.fullchain.pem
Note

Use the actual downloaded filenames if they differ from these examples. All certificates must be in PEM format, with each -----BEGIN CERTIFICATE----- block starting on a new line. A .crt file can also contain PEM-formatted text.
RapidSSL certificates

Open the DigiCert Trusted Root Authority Certificates page and locate the intermediate certificate corresponding to your RapidSSL certificate.

For certificates issued through RapidSSL TLS RSA CA G1, download the matching intermediate certificate in PEM format. In the examples below, its filename is:

RapidSSL-TLS-RSA-CA-G1.pem
Important: Confirm that RapidSSL TLS RSA CA G1 is the correct issuer for your certificate. Other RapidSSL issuing hierarchies may require a different intermediate certificate.

Create the full certificate chain by placing your domain certificate first, followed by the intermediate certificate.

Linux:

(cat your-domain.com.crt; printf '\n'; cat RapidSSL-TLS-RSA-CA-G1.pem) > your-domain.com.fullchain.pem

Windows (Command Prompt):

(type your-domain.com.crt & echo. & type RapidSSL-TLS-RSA-CA-G1.pem) > your-domain.com.fullchain.pem
Sectigo certificates

Download the appropriate intermediate certificate or CA Bundle from the Sectigo Public Intermediates and Roots page.

For the examples below, the downloaded certificate chain is named:

sectigo-ca-bundle.pem
Important: The required Sectigo chain depends on the issuing CA. Make sure the intermediate certificate or CA Bundle matches the issuer of your SSL certificate.

Create the full certificate chain by placing the domain certificate first, followed by the intermediate certificate or CA Bundle in the correct order.

Linux:

(cat your-domain.com.crt; printf '\n'; cat sectigo-ca-bundle.pem) > your-domain.com.fullchain.pem

Windows (Command Prompt):

(type your-domain.com.crt & echo. & type sectigo-ca-bundle.pem) > your-domain.com.fullchain.pem

After creating your-domain.com.fullchain.pem for the appropriate CA, continue with Step 2.

Step 2: Move the certificate files to the appropriate directories

Move the private key generated with your Certificate Signing Request (CSR) to a secure directory. For example:

/etc/ssl/ssl.key/server.key

Move the full certificate chain created in Step 1 to the certificate directory. For example:

/etc/ssl/ssl.crt/your-domain.com.fullchain.pem
Security: The private key must have restricted filesystem permissions and must never be stored in a publicly accessible web directory or shared with unauthorized users.

Note: Certificate and private key locations vary between Linux distributions and server configurations. Use the paths appropriate for your system, and make sure Apache can read the necessary files.

Step 3: Locate and edit the Apache SSL configuration

Open the Apache SSL VirtualHost configuration with your preferred text editor, such as nano, vim, Notepad or Notepad++.

Typical configuration locations include:

DistributionCommon configuration paths
Fedora / CentOS / RHEL /etc/httpd/conf/httpd.conf
/etc/httpd/conf.d/ssl.conf
Debian / Ubuntu /etc/apache2/apache2.conf
/etc/apache2/sites-available/
/etc/apache2/sites-enabled/

The SSL VirtualHost may be defined in a separate file that is included from the main Apache configuration. If you are unsure where it is located, look for the Include and IncludeOptional directives.

For more information, see the official Apache mod_ssl documentation.

Step 4: Configure the SSL VirtualHost

For Apache 2.4.8 and newer, the server certificate and its intermediate certificates can be included in the same fullchain file.

Add or update these directives inside the correct HTTPS VirtualHost:

SSLEngine on
SSLCertificateKeyFile /etc/ssl/ssl.key/server.key
SSLCertificateFile /etc/ssl/ssl.crt/your-domain.com.fullchain.pem
Apache 2.4.8 and newer

You do not need a separate SSLCertificateChainFile directive when the intermediate certificates are included in the file configured with SSLCertificateFile. The SSLCertificateChainFile directive is obsolete for this configuration.

If you are using an older Apache version that requires a separate chain file, configure the domain certificate and intermediate certificates separately according to that version's documentation.

Step 5: Check the configuration and reload Apache

Before reloading the web server, check the Apache configuration for errors:

apachectl configtest

When the result is Syntax OK, reload the appropriate Apache service.

Debian / Ubuntu:

systemctl reload apache2

CentOS / RHEL / Fedora:

systemctl reload httpd
Verify your installation

Visit https://your-domain.com and confirm that the site opens without a certificate warning.

You can also inspect the certificates presented by the server with OpenSSL:

openssl s_client -connect your-domain.com:443 -servername your-domain.com -showcerts

Single SSL certificate on multiple servers

If your website is hosted on multiple web servers, you normally do not need a separate SSL certificate for each server. The same SSL certificate and its corresponding private key can be installed on every server hosting a domain name covered by that certificate.

Download the certificate from the ClouDNS web panel and obtain the appropriate Actalis, RapidSSL or Sectigo certificate chain using Step 1. Securely copy the fullchain file and the private key originally used to create the CSR to each server, and repeat the Apache configuration procedure.

For a Wildcard SSL certificate, the wildcard hostname must be included in the certificate, for example:

*.domain.com
Important: If your private key is password-protected, Apache may request the password at startup or restart. The service cannot complete startup until the password is provided.

Apache configuration file names and directory structures depend on the operating system and distribution. Common files include httpd.conf, apache2.conf and ssl.conf. Individual websites may also have their own VirtualHost configuration files under directories such as sites-available and sites-enabled.

Refer to the documentation for your operating system and Apache installation to confirm the correct file locations before making changes.

Last modified: 2026-10-16
Online - Live Chat
We value your privacy! We use cookies to enhance your browsing experience, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Cookie Policy.