Skip to main content

Apache HTTP Server

Deploys certificates to Apache servers via SSH, using a CLM agent as an intermediary.

Prerequisites​

  • Linux CLM agent installed and online with SSH access to the target server
  • SSH user with write permission on the target file paths
  • Apache installed with the mod_ssl module enabled
  • Certificate destination directory created on the server

Prepare the server​

Enable the SSL module​

Check whether mod_ssl is enabled:

# Ubuntu/Debian
a2enmod ssl
systemctl reload apache2

# CentOS/RHEL
httpd -M | grep ssl

Create the certificate directory​

If the directory doesn't exist yet:

mkdir -p /etc/apache2/ssl
chmod 755 /etc/apache2/ssl

Identify the certificate paths​

To find out where Apache is reading the certificates from, run on the server:

grep -r "SSLCertificateFile" /etc/apache2/
# or on CentOS/RHEL
grep -r "SSLCertificateFile" /etc/httpd/

The result shows the paths configured in the virtual host, for example:

/etc/apache2/sites-available/my-site.conf:    SSLCertificateFile /etc/apache2/ssl/my-site.crt
/etc/apache2/sites-available/my-site.conf:    SSLCertificateKeyFile /etc/apache2/ssl/my-site.key
/etc/apache2/sites-available/my-site.conf:    SSLCertificateChainFile /etc/apache2/ssl/my-site-chain.crt

Use exactly these paths when configuring the store.

SSH user permissions​

The SSH user configured on the store needs write permission on the certificate directory. If you're using a non-root user:

# Grant permission on the directory to the user
chown root:<user> /etc/apache2/ssl/
chmod 770 /etc/apache2/ssl/

# Ubuntu/Debian — allow passwordless reload via sudo
echo "<user> ALL=(ALL) NOPASSWD: /bin/systemctl reload apache2" >> /etc/sudoers

# CentOS/RHEL — allow passwordless reload via sudo
echo "<user> ALL=(ALL) NOPASSWD: /bin/systemctl reload httpd" >> /etc/sudoers

Create via the Stores screen​

Step 1 — Provider​

Select Unix Provider.

Step 2 — Agent​

Select the Linux agent that will establish the SSH connection to the target server.

Step 3 — Configuration​

SSH Connection:

FieldDescription
Host / IPAddress of the Apache server
SSH PortSSH port (default: 22)
SSH UserUser with write permission on the configured paths
SSH PasswordUser's password (optional if using an SSH key)

Certificate file paths:

FieldExampleDescription
Certificate file path/etc/apache2/ssl/my-site.crtFull path to the leaf certificate
Private key file path/etc/apache2/ssl/my-site.keyFull path to the private key
CA Chain file path/etc/apache2/ssl/my-site-chain.crtIntermediate chain (optional)
Where to find the paths
The correct paths are the ones defined in the `SSLCertificateFile`, `SSLCertificateKeyFile`, and `SSLCertificateChainFile` directives of your Apache virtual host. Use `grep -r "SSLCertificateFile" /etc/apache2/` to locate them.

Service configuration:

DistributionReload command
Ubuntu / Debiansystemctl reload apache2
CentOS / RHELsystemctl reload httpd
If the SSH user isn't root, use `sudo systemctl reload apache2` and make sure the sudoers rule is configured as described in [SSH user permissions](#ssh-user-permissions).

Step 4 — Review​

Set the Repository Name, confirm the settings, and click Create Repository.

How the deploy works​

When a certificate is installed or renewed, the CLM:

  1. Connects to the server via SSH using the configured agent
  2. Writes the files to the configured paths (certificate, key, chain)
  3. Runs the Reload command to apply the new certificate to Apache without interrupting the service

Install a certificate​

On the Store details screen, click Install Certificate, select the certificate from the inventory, and confirm.

Troubleshooting​

Deploy fails at step 1​

The agent couldn't write the file to the destination. Check:

# Confirm the directory exists
ls -la /etc/apache2/ssl/

# Test write access with the configured SSH user
su - <user> -c "touch /etc/apache2/ssl/test && echo OK && rm /etc/apache2/ssl/test"

If it returns Permission denied, adjust the permissions as described in SSH user permissions.

Apache doesn't apply the new certificate after the deploy​

Check the configuration and reload manually:

# Ubuntu/Debian
apachectl configtest && systemctl reload apache2

# CentOS/RHEL
httpd -t && systemctl reload httpd

SSL module not found​

# Ubuntu/Debian
a2enmod ssl && systemctl reload apache2