How to install SSL certificate on server in 2025

I’m sharing a complete, practical guide to installing SSL certificates on servers in 2025, so you can deploy HTTPS confidently without getting lost in cryptic logs or incomplete documentation.

Jul 24, 2025

If you’re managing a website in 2025, SSL is no longer optional. It’s a baseline expectation for any user-facing project, whether you’re hosting a blog, an e-commerce platform, or an internal tool.

I remember my first SSL installation on back in 2018. I thought it would take five minutes, but it turned into a day of troubleshooting certificate mismatches, file permission issues, and silent failures. Once I learned the structured approach—preparing the right files, configuring VirtualHosts correctly, and validating every step—SSL installation became a routine task that improves security, SEO, and user trust.

In this Substack issue, I’m sharing a complete, practical guide to installing SSL certificates on servers in 2025, so you can deploy HTTPS confidently without getting lost in cryptic logs or incomplete documentation.

Why SSL/TLS is critical in 2025

Browsers mark HTTP sites as “Not Secure.”
Search engines prioritize HTTPS pages in rankings.
Data transmitted over HTTP can be intercepted or modified.
SSL/TLS encrypts your users’ sessions, safeguarding credentials and personal information.
It also ensures you meet compliance requirements for data privacy in most jurisdictions.

HTTPS is now a fundamental signal of professionalism and reliability for your website.

Types of SSL Certificates for

Before installation, you need to know which type of certificate suits your needs:

✅ DV (Domain Validation) – Fast, validates only domain ownership.
✅ OV (Organization Validation) – Validates your organization’s identity.
✅ EV (Extended Validation) – Highest validation, shows your company name in browsers.
✅ Wildcard Certificates – Cover your domain and all subdomains.
✅ SAN (Subject Alternative Name) – Covers multiple domains in a single certificate.

If you’re managing multiple sites or subdomains, consider SAN or Wildcard certificates to reduce renewal headaches.

Required files for SSL installation

To install an SSL certificate on , you will typically need:

Private Key (.key): Generated during CSR creation. Keep this secure and private.
Certificate (.crt or .pem): Issued by your CA after validation.
Intermediate Certificates (CA Bundle): Bridges your certificate to the root CA.
Full-chain Certificate (optional): Combines your certificate and intermediates for simplified deployment.

Best practice: Store these securely:

Certificates → /etc/ssl/certs/
Private Key → /etc/ssl/private/ with chmod 600 for permissions.

Step-by-step SSL installation on

1️⃣ Upload certificate and key files

Download your certificate files from your CA, then upload them to your server:

sudo cp example_com.crt /etc/ssl/certs/

sudo cp ca_bundle.crt /etc/ssl/certs/

sudo cp example_com.key /etc/ssl/private/

sudo chmod 600 /etc/ssl/private/example_com.key

2️⃣ Locate configuration files

Depending on your system:

Ubuntu/Debian: /etc/2/sites-available/
CentOS/RHEL: /etc/httpd/conf.d/ssl.conf or /etc/httpd/conf/httpd.conf

Look for or create a <VirtualHost *:443> block for SSL configuration.

3️⃣ Configure VirtualHost with SSL

Your VirtualHost block should resemble:

ServerName www.example.com

DocumentRoot /var/www/html

SSLEngine on

SSLCertificateFile /etc/ssl/certs/example_com.crt

SSLCertificateKeyFile /etc/ssl/private/example_com.key

SSLCertificateChainFile /etc/ssl/certs/ca_bundle.crt

SSLOptions +StrictRequire

</VirtualHost>

If using a full-chain file, replace SSLCertificateFile with it and skip SSLCertificateChainFile.

4️⃣ Enable SSL modules

On Ubuntu/Debian:

sudo a2enmod ssl

On CentOS/RHEL:

sudo yum install mod_ssl

5️⃣ Enable OCSP Stapling and HSTS

Enhance your SSL configuration:

SSLUseStapling on

SSLStaplingCache shmcb:/var/run/ocsp(128000)

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

6️⃣ Restart

Test your configuration:

sudo ctl configtest

Restart the server:

sudo systemctl restart 2

sudo systemctl restart httpd

7️⃣ Verify your SSL installation

✅ Visit https://yourdomain.com in your browser and check for the padlock.
✅ Run:

curl -vI https://yourdomain.com

✅ Use SSL Labs SSL Test for a full audit.

Automating SSL with Let’s Encrypt and Certbot

Manual renewals can lead to expired certificates and downtime. Let’s Encrypt offers free SSL certificates, while Certbot automates issuance and renewal.

Installation:
Ubuntu/Debian:

sudo apt install certbot python3-certbot-

CentOS/RHEL:

sudo yum install epel-release

sudo yum install certbot python3-certbot-

Run:

sudo certbot --

This auto-configures your VirtualHost, installs the certificate, and reloads .

Verify auto-renewal:

sudo certbot renew --dry-run

Let’s Encrypt certificates expire every 90 days, but Certbot ensures seamless renewals.

Security hardening for SSL

After installation:
✅ Enforce strong protocols:

SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

✅ Use strong cipher suites:

SSLCipherSuite HIGH:!aNULL:!MD5:!3DES

SSLHonorCipherOrder on

✅ Enable HTTP/2 for performance:

Protocols h2 http/1.1

✅ Add security headers:

Header set X-Frame-Options DENY

Header set X-Content-Type-Options nosniff

Header set Referrer-Policy "strict-origin-when-cross-origin"

Common SSL issues and how to fix them

🔹 won’t start: Check ctl configtest and file permissions.
🔹 “Not Secure” warnings: Often due to incomplete certificate chains.
🔹 OCSP stapling errors: Check outbound firewall rules and NTP time sync.
🔹 Renewal failures: Verify DNS A/AAAA records and use certbot renew --dry-run.

Final thoughts

Learning how to install SSL certificates on in 2025 equips you with a critical skill for managing secure, modern web infrastructure.

It’s more than just getting the padlock icon; it’s about protecting your users, maintaining your SEO rankings, and complying with modern security standards. With automation via Let’s Encrypt and a hardened configuration, you can ensure your server remains secure and trusted, minimizing maintenance while maximizing reliability.

Ready to secure your server?

✅ Explore the full tutorial here:

https://safelyo.com/how-to-install-ssl-certificate-on-apache-server/

# #WebSecurity #Safelyo #MichaleDang #SSL