English

简体中文

English

简体中文

Appearance

Apache Setup ​

For servers running Apache.

This page uses Certbot to issue the certificate and configure Apache automatically.

1. Set Variables ​

bash
export ACME_SERVER="your Server URL"
export EAB_KID="your EAB MAC ID"
export EAB_HMAC_KEY="your EAB MAC key"
export EMAIL="[email protected]"
export DOMAIN="example.com"
export WWW_DOMAIN="www.example.com"

2. Install Certbot ​

Ubuntu / Debian:

bash
sudo apt update
sudo apt install -y certbot python3-certbot-apache

AlmaLinux / Rocky Linux / CentOS:

bash
sudo dnf install -y epel-release || sudo yum install -y epel-release
sudo dnf install -y certbot python3-certbot-apache || sudo yum install -y certbot python3-certbot-apache

Snap:

bash
sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot
sudo ln -sf /snap/bin/certbot /usr/bin/certbot

3. Issue and Install ​

Single domain, including example.com and www.example.com by default:

bash
sudo certbot --apache \
  --non-interactive \
  --agree-tos \
  --email "$EMAIL" \
  --server "$ACME_SERVER" \
  --eab-kid "$EAB_KID" \
  --eab-hmac-key "$EAB_HMAC_KEY" \
  --domain "$DOMAIN" \
  --domain "$WWW_DOMAIN" \
  --cert-name "$DOMAIN"

Multiple domains:

bash
sudo certbot --apache \
  --non-interactive \
  --agree-tos \
  --email "$EMAIL" \
  --server "$ACME_SERVER" \
  --eab-kid "$EAB_KID" \
  --eab-hmac-key "$EAB_HMAC_KEY" \
  --domain example.com \
  --domain www.example.com \
  --domain api.example.com \
  --cert-name example.com

4. Wildcard Certificate ​

Wildcard coverage should include:

text
example.com
*.example.com

Wildcard certificates require DNS validation. The --apache HTTP flow cannot issue wildcard certificates.

Cloudflare DNS API example:

bash
export CF_Token="Cloudflare API Token"
export CF_Account_ID="Cloudflare Account ID"

~/.acme.sh/acme.sh --issue \
  --dns dns_cf \
  -d "$DOMAIN" \
  -d "*.$DOMAIN" \
  --server "$ACME_SERVER"

After issuance, install the certificate files and configure SSLCertificateFile and SSLCertificateKeyFile in Apache.

5. Check ​

bash
sudo apachectl configtest
curl -I "https://$DOMAIN"
sudo certbot certificates

Open:

text
https://example.com

6. Renewal Test ​

bash
sudo certbot renew --dry-run