Rekeying an SSL certificate on Apache means creating a new private key and CSR, having a certificate authority issue a certificate for that CSR, installing the certificate and intermediate chain, confirming that the certificate matches the new key, and reloading Apache. Keep the old key, certificate, and configuration available until the replacement has been tested in production so you can roll back safely.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What rekeying changes
A certificate rekey is not a simple replacement of an expiring certificate file. You generate a new private key first, create a CSR from that key, and obtain a newly signed certificate from a certificate authority (CA). The new certificate is then connected to the Apache HTTPS VirtualHost that serves your hostname.
As an Amazon Associate I earn from qualifying purchases.
The hostname normally stays the same, but the cryptographic key pair changes. That distinction matters when a key may have been exposed, when a CA requires a fresh key for renewal, or when you want to replace an old key without waiting for the current certificate to expire. A certificate issued for an old key cannot be paired with the new private key.
A complete rekey has these stages:
- Inventory the active Apache configuration and preserve the working files.
- Generate a new private key and CSR containing every required hostname.
- Submit the CSR to a CA, or use an ACME client such as Certbot.
- Install the server certificate, private key, and intermediate chain.
- Verify the certificate/key relationship and the chain before activation.
- Run Apache’s configuration test, reload the service, and test the live endpoint.
Plan the change before touching the live site
Confirm the names the certificate must cover
List every DNS name clients use, such as the bare domain and its www name, API names, mail-related names, or service-specific hostnames. Modern certificates use the Subject Alternative Name (SAN) extension for this list. A Common Name containing the site FQDN remains useful for compatibility and is the value Apache’s documentation asks for when OpenSSL prompts for Common Name, but do not rely on Common Name alone when SANs are required.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Missing a hostname from the CSR produces a certificate that is valid for only part of the deployment. Pass every required name to the CA’s request tooling. With Certbot, each name must be supplied with its own -d option.
Identify the VirtualHost that actually serves HTTPS
Apache can have several enabled sites and several HTTPS VirtualHosts. Find the enabled block for the hostname being rekeyed, typically under /etc/apache2/sites-enabled/, and record its current SSLCertificateFile, SSLCertificateKeyFile, and any chain directive. The certificate can be perfectly valid yet appear unchanged if you edit a disabled file or the wrong VirtualHost.
Recommended Free Tools
Make a rollback copy
Copy the current certificate, private key, and relevant Apache site configuration to a protected backup location before generating anything. Keep the old key separate from the new key and do not overwrite the active files while the replacement is being issued. Preserve the backup until an independent client confirms the new certificate and rollback is no longer needed.
Check prerequisites
- Administrative access with
sudo. - OpenSSL and Apache’s SSL module installed.
- Access to the CA account or ACME challenge environment.
- DNS control when the CA requires a DNS-01 challenge or when names must be corrected.
- A maintenance window or a tested reload procedure for the production service.
Generate a new private key and CSR
Run the key and CSR commands in a working directory that is not publicly served. The traditional RSA example documented for Apache is:
openssl genrsa -des3 -out server.key 2048
openssl req -new -key server.key -out server.csrThe first command creates a new 2048-bit RSA key and protects it with a passphrase. The second creates a CSR from that exact key. OpenSSL prompts for the certificate subject and challenge information; enter the fully qualified domain name when it asks for Common Name. Supply all additional DNS names through the CA’s SAN-capable request process.
Do not reuse the old private key if the purpose of the operation is a genuine rekey. Keep server.key and server.csr distinct from the old files until the CA has issued the certificate and you have completed verification. Restrict access to the new key while it is on disk. The account that runs Apache must be able to read the production key, but ordinary users and web applications should not.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Passphrase trade-off
An encrypted private key protects the file if it is copied, but Apache may need the passphrase during startup. Apache’s security guidance warns: “Removing the pass-phrase removes a layer of security from your server – proceed with caution!” Ubuntu makes the operational risk explicit: “Running your secure service without a passphrase is convenient but insecure – a compromise of the key means a compromise of the server as well.”
If unattended startup requires an unencrypted key, limit ownership and permissions, keep an encrypted backup offline, and treat access to the key as access to the server’s TLS identity. Do not place a private key in a document root, source repository, ticket, or chat transcript.
Obtain the newly signed certificate
Manual CA issuance
Submit server.csr to the CA selected for the service. Follow that CA’s documented validation method and download the issued server certificate plus the intermediate certificate or bundle. Keep the files in their original PEM form; do not paste a certificate into a key file or alter the PEM headers and footers.
Apache-managed ACME issuance with Certbot
For a Let’s Encrypt or other ACME deployment using Certbot’s Apache plugin, Ubuntu documents this pattern:
sudo certbot --apache -d example.com -d www.example.comReplace the example names with every hostname that must be covered. Certbot’s Apache plugin finds the VirtualHost matching the requested domains, writes the TLS directives in place, and reloads Apache. This is convenient when the site follows the plugin’s expected layout. A nonstandard proxy arrangement, centralized certificate store, or restricted web root may instead require the CA’s documented DNS-01 or centralized ACME workflow.
Manual issuance gives you direct control over CSR creation, file locations, and the reload hook. ACME automation reduces repetitive issuance work and can renew without a human submitting each CSR, but it may require DNS/API access and careful permission management. Decide which model fits the way this server is operated before changing the live configuration.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Install the certificate, key, and chain
Typical Ubuntu paths for a manually issued certificate
Ubuntu commonly stores public certificates in /etc/ssl/certs and private keys in /etc/ssl/private. Copy the new files into protected locations, then reference those exact paths in the HTTPS VirtualHost:
SSLCertificateFile /etc/ssl/certs/example.com.crt
SSLCertificateKeyFile /etc/ssl/private/example.com.key
# If your Apache version/configuration uses a separate chain file:
SSLCertificateChainFile /etc/ssl/certs/issuer-chain.pemThe server certificate belongs in SSLCertificateFile; the matching new private key belongs in SSLCertificateKeyFile. A separate chain file is used only where the Apache version and configuration expect one. Follow the directives already supported by that installation rather than adding a duplicate chain directive blindly.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Certbot’s live directory
Certbot-managed files normally live under /etc/letsencrypt/live/<domain>/. In that layout, fullchain.pem contains the server certificate followed by the intermediate certificates, and privkey.pem contains the private key. Point Apache at the paths supplied by Certbot instead of copying files out of the live directory unless you have a specific, maintained deployment process.
Do not confuse a server certificate with a CA chain. Clients may reject a site that sends only the leaf certificate even though the leaf itself is valid. Preserve the chain order supplied by the CA: the server certificate first, followed by the intermediates needed to reach a trusted root.
Verify the new certificate before activating it
Confirm that the certificate and private key match
Apache’s documented modulus comparison is a quick way to prove that the new certificate was issued from the new key:
openssl x509 -noout -modulus -in new.crt | openssl md5
openssl rsa -noout -modulus -in new.key | openssl md5The two resulting digests must be identical. The MD5 output here is used only as a compact comparison of the two modulus values; it is not being used to secure traffic. If the digests differ, stop. Check that you selected the intended certificate and key, then request a replacement certificate for the correct CSR if necessary.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Inspect identity and validity
Review the subject, issuer, validity period, and SAN list:
openssl x509 -in new.crt -noout -subject -issuer -dates -ext subjectAltNameConfirm that every production hostname appears in the SAN output, that the issuer is the CA you selected, and that the start and expiry dates are appropriate for the deployment. A correct key match does not make a certificate valid for the wrong name or an expired date.
Check the chain against Ubuntu’s trust store
For a manually supplied intermediate bundle, validate the leaf against Ubuntu’s CA bundle:
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt -untrusted issuer-chain.pem new.crtThe trust-store path can vary by Ubuntu release or local configuration. A successful result indicates that OpenSSL can build a chain using the supplied intermediates and the selected trust store. If verification fails, check that the intermediate file is complete, in the correct order, and belongs to the certificate’s issuer.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUpdate the correct Apache HTTPS VirtualHost
Edit the enabled HTTPS VirtualHost identified during inventory. A minimal arrangement looks like this:
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
SSLEngine on
SSLCertificateFile /etc/ssl/certs/example.com.crt
SSLCertificateKeyFile /etc/ssl/private/example.com.key
SSLCertificateChainFile /etc/ssl/certs/issuer-chain.pem
# Existing DocumentRoot, proxy, logging, and application directives remain here.
</VirtualHost>Use the real hostnames and paths, and retain the site’s existing application directives. If the installation uses Certbot’s fullchain.pem, reference that file as the certificate file and the corresponding privkey.pem as the key file. Do not change an unrelated VirtualHost simply because it is the first file you find.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Check Apache, enable SSL if needed, and reload
- Ensure the SSL module is enabled:
sudo a2enmod ssl. Enable the HTTPS site as well if this installation has a separate disabled site configuration. - Run Apache’s configuration check before affecting the running service:
sudo apache2ctl configtest. Continue only when it reports a successful syntax check. - Apply the new files with a graceful reload:
sudo systemctl reload apache2. - If reload is unavailable, or the encrypted key requires an interactive passphrase at startup, use the documented restart path and provide the passphrase through the server’s secure console or startup mechanism.
A configuration test checks syntax and many file references, but it does not prove that the intended certificate is being served to the public. The endpoint test is a separate required step.
Test the certificate from outside the server
Request the site over HTTPS from an independent client or monitoring host. Inspect the certificate actually delivered on the network, not only the file on disk. Check the served subject and SANs, issuer, expiry, and whether the client receives the complete chain. Include the hostname during testing so Apache selects the same SNI-based VirtualHost that real visitors use.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor a command-line check, OpenSSL can show the handshake and presented chain:
openssl s_client -connect example.com:443 -servername example.com -showcertsRead the leaf certificate shown by the handshake and compare it with the newly installed certificate. Test each important hostname, because a default VirtualHost can return a different certificate when a name is omitted or mapped incorrectly.
Test automated renewal without changing certificates
For a Certbot-managed deployment, run:
sudo certbot renew --dry-runThis exercises the renewal workflow without replacing the live certificate. Review any challenge, permission, hook, or reload error now rather than waiting for the next renewal window.
Troubleshoot a failed reload or incorrect certificate
| Symptom | Likely cause | What to check |
|---|---|---|
apache2ctl configtest fails |
Malformed PEM, invalid directive, or an incorrect path | Open the referenced file, confirm its PEM headers and footers, check spelling and permissions, then run the test again. |
| Apache says the key does not match the certificate | The certificate was issued from a different CSR or the wrong file was selected | Repeat the modulus comparison for the exact files named by SSLCertificateFile and SSLCertificateKeyFile. |
| Apache cannot read the private key | Ownership, mode, directory traversal permission, or an unavailable passphrase | Ensure the Apache startup account can read the protected key, remove accidental world access, and provide the passphrase through the supported startup process if the key is encrypted. |
| The old certificate is still served | The edited VirtualHost is disabled, a different VirtualHost wins SNI selection, or Apache was not reloaded | Confirm the enabled site, exact hostname, certificate paths, and reload result. Test with the hostname supplied through SNI. |
| Browsers report an incomplete chain | The intermediate certificate was omitted or placed in the wrong directive | Install the CA-provided chain, use the correct chain directive for the Apache version, or use Certbot’s fullchain.pem layout. |
| A hostname warning appears | The SAN list does not include the requested DNS name | Inspect subjectAltName. Generate a new CSR containing every required name and obtain a replacement certificate. |
| Certbot renewal dry-run fails | Challenge access, DNS/API credentials, file permissions, or the reload hook is broken | Read Certbot’s error output, verify the selected challenge method, and correct the deployment hook before the real renewal date. |
Apache’s error log is the next place to look when a reload or restart fails without enough detail at the terminal. Do not delete the old working files while diagnosing the replacement; they provide the fastest rollback path.
Rollback and post-change cleanup
If the new service fails, restore the previous certificate, key, and VirtualHost paths, run sudo apache2ctl configtest, and reload or restart Apache using the same service procedure. Once the new certificate has been confirmed by independent clients and the rollback period has passed, remove only unnecessary copies. Retain an encrypted backup of the old key according to your operational retention policy, and securely erase temporary CSR and certificate files that no longer have a purpose.
Keep a record of which CSR produced the active certificate, which hostnames it covers, where the files live, and how renewal is tested. That record prevents a future operator from pairing a certificate with the wrong key or editing a dormant VirtualHost.
Manual issuance versus Certbot/ACME
| Decision point | Manual CA issuance | Certbot with Apache/ACME |
|---|---|---|
| Issuance method | Create a CSR, submit it to the CA, download the signed certificate and chain. | Run an ACME client that performs the configured challenge and requests the certificate. |
| Hostname coverage | Put every required DNS name in the CSR/CA request, normally as SANs. | Pass every required name with -d; the requested names are placed in the certificate. |
| Renewal | Usually requires a planned CSR submission and installation procedure unless separately automated. | Supports scheduled renewal; sudo certbot renew --dry-run tests the workflow without changing the live certificate. |
| File layout | Common Ubuntu locations are /etc/ssl/certs and /etc/ssl/private, with directives chosen by the administrator. |
Certbot supplies files under /etc/letsencrypt/live/<domain>/, including fullchain.pem and privkey.pem. |
| Reload behavior | You choose and test the Apache reload or restart hook. | The Apache plugin updates matching directives and reloads Apache during issuance; verify that this fits local service controls. |
| DNS/API requirements | Depends on the CA validation method; DNS-01 may require DNS control. | HTTP-01, DNS-01, or a centralized workflow may require web-server access or DNS/API credentials. |
| Private-key control | You generate and place the key directly, with maximum control over storage and permissions. | The key remains on the server while the ACME client automates issuance; protect the Certbot directories and renewal account. |
Neither approach changes the essential safety checks: the CSR must cover the right names, the certificate must match the new key, the chain must validate, and the exact HTTPS VirtualHost must serve the result.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
