# Setup Apache

The following is an example setup process for Apache, please adopt to your exact needs.

## Apache SSLOpenSSLConfCmd DHParameters

For Apache 2.4.8 or later and OpenSSL 1.0.2 or later, you can generate and specify your Diffie-Hellman (DH) params file. If not already present, add an SSLOpenSSLConfCmd directive and a new certificate with stronger keys (which improves forward secrecy). The OpenSSL command may take a quite a while to complete, so please be patient.

You can place the certificate into any directory of your choice. We recommend `/etc/apache2/` in this guide, just for the sake of simplicity.

    sudo openssl dhparam -out /etc/apache2/dh4096.pem 4096

Add the following directive to your common SSL configuration:

    SSLOpenSSLConfCmd DHParameters /etc/apache2/dh4096.pem

Add the `/.well-known/acme-challenge` location in your Virtual Host directive for port 80

    <virtualHost *.80>
      ServerName mydom.tld

      Alias /.well-known/acme-challenge/ /var/www/letsencrypt/.well-known/acme-challenge/
      <Directory "/var/www/letsencrypt/.well-known/acme-challenge/">
          Options None
          AllowOverride None
          ForceType text/plain
          RedirectMatch 404 "^(?!/\.well-known/acme-challenge/[\w-]{43}$)"
      </Directory>

      # ...
    </virtualHost>

## Prepare a virtualHost directive for port 443

It is easiest, if you create a separate file for the following `SSL` directives. If these directives already exist in this Virtual Host, delete them and include the file instead. When the certificate has been created, you can use this file in any SSL Virtual Host for which the certificate is valid, without reissuing.

    cd /etc/apache2/
    sudo mkdir ssl_rules

Create a file named `ssl_mydom.tld` in the newly created directory.

    # ssl rules for mydom.tld
    # eases letsencrypt initial cert issuing

    SSLEngine on

    SSLCertificateChainFile  /etc/letsencrypt/live/mydom.tld/fullchain.pem
    SSLCertificateKeyFile    /etc/letsencrypt/live/mydom.tld/privkey.pem
    SSLCertificateFile       /etc/letsencrypt/live/mydom.tld/cert.pem

To reduce the SSL performance penalty, we recommend you use the SSLUseStapling and SSLStaplingCache directives: Here’s an example configuration:

    SSLUseStapling on
    SSLStaplingCache         shmcb:/tmp/stapling_cache(2097152)

Then adopt your Virtual Host block:

    <virtualHost *:443>
      ServerName mydom.tld

      # ssl letsencrypt
      # Include /etc/apache2/ssl_rules/ssl_mydom.tld

      #...
    </virtualHost>

Commenting the `Include` directive is required, because the certificate files currently do not exist.

## Test and enable your Apache configuration

To test your configuration run

    sudo apache2ctl -t # You can also use: sudo apache2ctl configtest

It should reply without errors. Load your new Apache configuration:

    sudo apache2ctl graceful

### Creating certificates

Check that you have commented out the `Include` directive as stated above and run the following command:

    sudo /etc/letsencrypt/<your-domain-name>.sh

To double check the issued certificate, run the `list.sh` script.

    sudo /etc/letsencrypt/list.sh

If successful, you will see output similar to that below, when the command completes:

    Saving debug log to /var/log/letsencrypt/letsencrypt.log

    -------------------------------------------------------------------------------
    Found the following certs:
      Certificate Name: mydom.tld
        Domains: mydom.tld
        Expiry Date: 2018-06-18 10:57:18+00:00 (VALID: 89 days)
        Certificate Path: /etc/letsencrypt/live/mydom.tld/fullchain.pem
        Private Key Path: /etc/letsencrypt/live/mydom.tld/privkey.pem
    -------------------------------------------------------------------------------

When successfully issuing the certificate for the first time, the certificate files exist and you can un-comment the `Include` directive to use them with SSL.

    <virtualHost *:443>
      ServerName mydom.tld

      # ssl letsencrypt
      Include /etc/apache2/ssl_rules/ssl_mydom.tld

      #...
    </virtualHost>

## Reload the Apache configuration

    sudo service apache2 reload

Your web server is now ready to serve https request for the given domain using the issued certificates.