Deploying an SSL certificate requires many steps, such as generating the private key and certificate signature, obtaining the certificate, and configuring the SSL on the Web server. The following describes the process for deploying the SSL certificate on the Apache Web server.

Mister into private key:

openssl genrsa -out your_domain.key 2048

The above command generates a 2048-bit private key, stored in your_domain.key.

Generate CSR:

openssl req -new -key your_domain.key -out your_domain.csr

Fill in the information as prompted. The information is used to generate the CSR.

To obtain an SSL certificate, you can purchase an SSL certificate from the CA, provide a CSR to the CA, and wait for the audit. After the certificate is obtained, you can obtain the certificate. You can also purchase an SSL certificate directly from an IDC vendor. There are multiple types of certificates. Select a proper type based on the actual requirements.

To configure SSL in Apache, you need to create the SSL virtual host configuration, for example, /etc/apache2/sites-available/your_domain_ssl.conf:

sudo nano /etc/apache2/sites-available/your_domain_ssl.conf

Add content (depending on the actual situation) :

<VirtualHost *:443>

    ServerAdmin admin@example.com

    ServerName your_domain.com

    ServerAlias www.your_domain.com

    DocumentRoot /var/www/your_domain

    ErrorLog ${APACHE_LOG_DIR}/error.log

    CustomLog ${APACHE_LOG_DIR}/access.log combined

    SSLEngine on

    SSLCertificateFile /etc/letsencrypt/live/your_domain.com/cert.pem

    SSLCertificateKeyFile /etc/letsencrypt/live/your_domain.com/privkey.pem

    SSLCertificateChainFile /etc/letsencrypt/live/your_domain.com/chain.pem

</VirtualHost>

Point SSLCertificateFile, SSLCertificateKeyFile, and SSLCertificateChainFile to your certificate file.

Enable new configuration:

sudo a2ensite your_domain_ssl.conf

To restart the Apache service:

sudo systemctl restart apache2

You can use an SSL online tool such as SSL Server Test to check whether the SSL certificate configuration is correct or takes effect.

Ensure that the SSL certificate deployment website has a domain name controller, and the SSL certificate authority will verify it. Ensure the security of the certificate and private key to ensure the validity of the SSL certificate. In a production environment, make sure to generate keys with a key length of 2048 bits or more.

If you are configuring SSL on nginx, create a new configuration file or edit an existing configuration file, such as /etc/nginx/sites-availables/ your_domain_ssl.conf:

sudo nano /etc/nginx/sites-available/your_domain_ssl.conf

Added:

server {

    listen 443 ssl;

    server_name your_domain.com www.your_domain.com;

    ssl_certificate /etc/letsencrypt/live/your_domain.com/fullchain.pem;

    ssl_certificate_key /etc/letsencrypt/live/your_domain.com/privkey.pem;

    ssl_session_timeout 1d;

    ssl_session_cache shared:MozSSL:10m;   # about 40000 sessions

ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # disable SSLv3

    ssl_ciphers  'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE -RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';

    ssl_prefer_server_ciphers on;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds = 7280 hours = 300 days)

    add_header Strict-Transport-Security "max-age=63072000" always;

    # Add header to use HTTPS

    add_header X-Frame-Options DENY;

    add_header X-Content-Type-Options nosniff;

    # SSL Stapling

    ssl_stapling on;

    ssl_stapling_verify on;

resolver 8.8.8.8 8.8.4.4 valid=300s;

    resolver_timeout 5s;

    root /var/www/your_domain;

    index index.html index.htm;

    location / {

        try_files $uri $uri/ =404;

}

}

server {

    listen 80;

    server_name your_domain.com www.your_domain.com;

    return 301 https://$server_name$request_uri;

}

Point ssl_certificate and ssl_certificate_key to your certificate file. Create symbolic links:

sudo ln -s /etc/nginx/sites-available/your_domain_ssl.conf /etc/nginx/sites-enabled/

Test Nginx:

sudo nginx -t

To restart Nginx:

sudo systemctl restart nginx

Verify SSL deployment ditto.