How to change Certificate on Apache HTTP Server

Apache HTTP Server 2.4 uses SSLCertificateFile and SSLCertificateKeyFile in each TLS virtual host. On current 2.4 releases, the certificate file can include the intermediate chain after the leaf.

Before you begin

Inventory the effective virtual-host configuration with apachectl -S. Obtain a matching PEM certificate, chain, and private key. Back up files, symlinks, modes, ownership, and SELinux/AppArmor labels.

Step-by-step certificate replacement

1. Build fullchain.pem leaf first and verify the public keys match:

   cat leaf.pem intermediates.pem > fullchain.pem
   openssl pkey -in private.key -pubout | sha256sum
   openssl x509 -in leaf.pem -pubkey -noout | sha256sum

2. Install the chain and key at the paths referenced by the virtual host. The key can be root-only because Apache reads it during startup before dropping privileges:

   SSLEngine on
   SSLCertificateFile "/etc/apache2/tls/fullchain.pem"
   SSLCertificateKeyFile "/etc/apache2/tls/private.key"

3. Validate using the distribution's binary, then gracefully reload:

   apachectl configtest
   systemctl reload apache2  # Debian/Ubuntu
   # systemctl reload httpd  # RHEL/Fedora

   A graceful reload lets existing requests finish while new child processes read the new certificate. An encrypted private key can trigger a passphrase requirement at startup; unattended services need an approved key-management design.

Product-specific considerations

Use SSLCertificateChainFile only where required by an older Apache configuration; since 2.4.8 it is obsolete because intermediates can be included in SSLCertificateFile. Check every name-based virtual host and SNI name. Preserve mandatory access-control labels and avoid a hard restart unless the graceful reload fails for a documented reason.

Verify the new certificate

apachectl -S
openssl s_client -connect www.example.com:443 -servername www.example.com -showcerts </dev/null
journalctl -u apache2 --since "10 minutes ago"

Rollback

Restore the previous files or symlink, run apachectl configtest, and gracefully reload. Do not remove the replacement until the restored endpoint is verified.

Common problems

• Wrong httpd/apache2 service or configuration tree is changed.
• Certificate chain is incomplete or the key does not match.
• An encrypted key blocks a non-interactive reload.
• SELinux/AppArmor denies the new path.
• A different SNI virtual host is tested.

Automating certificate replacement with aethercert

The aethercert Apache preset writes the configured certificate/chain and private-key files and runs the configured reload command, whose default is systemctl reload apache2.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

Sources

• Apache HTTP Server 2.4 mod_ssl reference
• Apache HTTP Server stopping and restarting