Configure SSL/TLS with Apache on Ubuntu 26.04

Before you start

You need an Ubuntu Server with Apache2 installed, a user account that can run sudo (administrator rights on Linux), and network access from your Windows PC to the server. Each command below that starts with sudo needs administrator rights.

The examples use 192.0.2.10 as the server address, USERNAME as your account name, and www.example.com as the site name. Replace them with your own values.

Connect to the server from 🪟 Windows 11

Windows 11 includes an OpenSSH client (a built-in tool for remote command-line sessions), so you do not need extra software.

1. Right-click the Start button and choose Terminal.
2. Type the SSH command below and press Enter.
   

   💻Code

   Copy

   ssh USERNAME@192.0.2.10

3. Type yes if Windows asks you to trust the server’s fingerprint (a short code that identifies the server), then enter your password. You should now see the Ubuntu command prompt.

Install Apache2 if it is missing

Skip this section if Apache2 already runs on the server.

1. Update the package list and install Apache2. This step needs administrator rights, so start each command with sudo.
   

   🐧Bash / Shell

   Copy

   sudo apt update
   sudo apt install apache2

2. Check that the service is active.
   

   💻Code

   Copy

   systemctl status apache2

3. Look for active (running) in the output, then press Q to leave the status view.

Create a self-signed certificate

A self-signed certificate encrypts traffic, but no public authority vouches for it. Browsers show a warning until you trust it. If the server faces the internet, use a certificate from a public authority such as Let’s Encrypt instead.

1. Create the certificate and its private key (the secret file that proves the certificate is yours) in one command. This step needs administrator rights, so start the command with sudo. The -addext flag adds the site name that modern browsers check, which is called the Subject Alternative Name.
   

   🐧Bash / Shell

   Copy

   sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/example.key -out /etc/ssl/certs/example.crt -addext "subjectAltName=DNS:www.example.com"

2. Answer the prompts for country, organization and so on. For Common Name (the site name the certificate is issued for), enter the name people will use to reach the site, such as www.example.com.
3. Confirm both files exist.
   

   🐧Bash / Shell

   Copy

   ls -l /etc/ssl/certs/example.crt /etc/ssl/private/example.key

Anyone who has it can impersonate your server.

Point the SSL site at your certificate

Ubuntu ships a ready-made HTTPS site definition called default-ssl. You only need to change the certificate paths in it.

1. Open the file in the nano text editor (requires sudo).
   

   🐧Bash / Shell

   Copy

   sudo nano /etc/apache2/sites-available/default-ssl.conf

2. Find the line that starts with SSLCertificateFile and change it to the value shown below.
   

   💻Code

   Copy

   SSLCertificateFile /etc/ssl/certs/example.crt

3. Find the line that starts with SSLCertificateKeyFile and change it to the value shown below.
   

   💻Code

   Copy

   SSLCertificateKeyFile /etc/ssl/private/example.key

4. Add a ServerName line just below the ServerAdmin line.
   

   💻Code

   Copy

   ServerName www.example.com

5. Press Ctrl + O, then Enter to save. Press Ctrl + X to exit.

Enable SSL and restart Apache

These commands switch on the SSL module and the HTTPS site, then check your configuration before applying it.

1. Enable the SSL module (requires sudo).
   

   🐧Bash / Shell

   Copy

   sudo a2enmod ssl

2. Enable the HTTPS site.
   

   🐧Bash / Shell

   Copy

   sudo a2ensite default-ssl

3. Test the configuration for mistakes.
   

   🐧Bash / Shell

   Copy

   sudo apache2ctl configtest

4. Look for Syntax OK. A warning about the server's fully qualified domain name (the complete host address, such as server.example.com) is harmless, and the ServerName setting from the earlier step usually clears it. If you see an error instead, fix the file it names before going on.
5. Restart Apache.
   

   🐧Bash / Shell

   Copy

   sudo systemctl restart apache2

Allow HTTPS through the firewall

Skip this section if UFW (Ubuntu's firewall tool) is not active on the server. Check with sudo ufw status.

1. Allow TCP port 443, the standard HTTPS port (requires sudo).
   

   🐧Bash / Shell

   Copy

   sudo ufw allow 443/tcp

2. Run sudo ufw status and confirm that 443/tcp shows as ALLOW.

Test the HTTPS connection from Windows

1. Open a browser on your PC and go to https://www.example.com. If the name does not resolve, use https://192.0.2.10. A name that does not match the certificate triggers an extra warning.
2. Expect a security warning for a self-signed certificate. Select Advanced, then choose to continue to the site. You should see the Apache default page over HTTPS.
3. For a quick check without a browser, open Terminal and run:
   

   💻Code

   Copy

   curl.exe -k -I https://192.0.2.10

4. Look for HTTP/1.1 200 OK in the reply. The -k flag tells curl, a command-line tool that fetches web pages, to accept the self-signed certificate. Use it only for testing.

Trust the certificate on your Windows PC (optional)

Trust only a certificate you created yourself. A trusted root can vouch for any site its certificates cover, so trusting someone else's certificate is a security risk.

1. Copy the certificate to your PC. In Terminal, run:
   

   💻Code

   Copy

   scp USERNAME@192.0.2.10:/etc/ssl/certs/example.crt .

2. Double-click example.crt in the folder where you saved it, then select Install Certificate.
3. Choose Current User and select Next.
4. Select Place all certificates in the following store, then Browse.
5. Choose Trusted Root Certification Authorities and select OK.
6. Select Next, then Finish. Confirm the security prompt with Yes.
7. Restart your browser and reload the page. The warning should be gone, provided the address matches the name in the certificate.

To undo this, press Windows + R, type certmgr.msc, press Enter, open Trusted Root Certification Authorities › Certificates, right-click the certificate and choose Delete.

Redirect HTTP visitors to HTTPS (optional)

1. Open the default HTTP site file (requires sudo).
   

   🐧Bash / Shell

   Copy

   sudo nano /etc/apache2/sites-available/000-default.conf

2. Add this line inside the <VirtualHost *:80> block:
   

   💻Code

   Copy

   Redirect permanent / https://www.example.com/

3. Save the file and exit nano.
4. Reload Apache.
   

   🐧Bash / Shell

   Copy

   sudo systemctl reload apache2

5. Type http://www.example.com in your browser's address bar. The browser should then jump to the HTTPS address.

If the page does not load

1. If the page does not load, check that Apache is listening on port 443.
   

   🐧Bash / Shell

   Copy

   sudo ss -tlnp | grep 443

2. Then check the newest lines in the Apache error log.
   

   🐧Bash / Shell

   Copy

   sudo tail -n 30 /var/log/apache2/error.log

3. If the log mentions a certificate or key file, recheck the two paths in default-ssl.conf for typos.

What to do next

To undo the change, run sudo a2dissite default-ssl followed by sudo systemctl reload apache2. If the server is public, replace the self-signed certificate with a Let's Encrypt certificate so visitors see no warning. Then update the two SSLCertificate lines to point at the new files. Renewing or swapping a certificate later needs only a reload of Apache.