dotlinux blog

Securing Apache with Let’s Encrypt Certificate on Rocky Linux

In today's digital landscape, securing web applications is of utmost importance. One of the key aspects of web security is using HTTPS, which encrypts the data transmitted between a web server and a client. Let’s Encrypt is a free, automated, and open certificate authority that makes it easy to obtain and manage SSL/TLS certificates. In this blog post, we will walk you through the process of securing an Apache web server on Rocky Linux with a Let’s Encrypt certificate.

2026-04

Table of Contents#

Prerequisites#

Before we begin, make sure you have the following:

  • A Rocky Linux server with root access.
  • A registered domain name pointed to your server's IP address.
  • Apache web server installed (we will cover the installation process if you don't have it already).

Update System Packages#

First, update the system packages to ensure you have the latest security patches and software versions. Open a terminal and run the following command:

sudo dnf update -y

Install Apache Web Server#

If you haven't already installed Apache, you can do so using the following command:

sudo dnf install httpd -y

Once the installation is complete, start the Apache service and enable it to start on boot:

sudo systemctl start httpd
sudo systemctl enable httpd

Install Certbot#

Certbot is the official Let’s Encrypt client. To install Certbot on Rocky Linux, run the following commands:

sudo dnf install epel-release -y
sudo dnf install certbot python3-certbot-apache -y

Obtain a Let’s Encrypt Certificate#

Now that we have Certbot installed, we can obtain a Let’s Encrypt certificate for our domain. Run the following command, replacing your_domain.com with your actual domain name:

sudo certbot --apache -d your_domain.com -d www.your_domain.com

Certbot will prompt you to enter your email address and agree to the terms of service. Once you've done that, it will automatically configure Apache to use the SSL/TLS certificate.

Configure Apache to Use the SSL/TLS Certificate#

After obtaining the certificate, Certbot will automatically configure Apache to use the SSL/TLS certificate. However, it's a good idea to double-check the configuration. Open the Apache configuration file for your domain:

sudo nano /etc/httpd/conf.d/your_domain.com.conf

Make sure the following lines are present:

<VirtualHost *:80>
    ServerName your_domain.com
    ServerAlias www.your_domain.com
    Redirect permanent / https://your_domain.com/
</VirtualHost>
 
<VirtualHost *:443>
    ServerName your_domain.com
    ServerAlias www.your_domain.com
    DocumentRoot /var/www/html
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/your_domain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/your_domain.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

Save and close the file. Then, restart Apache to apply the changes:

sudo systemctl restart httpd

Verify the Installation#

To verify that the SSL/TLS certificate is installed correctly, open a web browser and navigate to https://your_domain.com. You should see a padlock icon in the address bar, indicating that the connection is secure.

Renewing the Certificate#

Let’s Encrypt certificates are valid for 90 days. To renew the certificate before it expires, run the following command:

sudo certbot renew --dry-run

If the dry run is successful, you can run the actual renewal command:

sudo certbot renew

Certbot will automatically renew the certificate and configure Apache to use the new certificate.

Conclusion#

In this blog post, we have walked you through the process of securing an Apache web server on Rocky Linux with a Let’s Encrypt certificate. By following these steps, you can ensure that your web applications are secure and protected from eavesdropping and man-in-the-middle attacks.

References#