Flash Sale:75% Off Hosting + Free DomainEnds in13h47m14sView Plans
Hostvento logoHostvento
Get Started

How to Move or Copy an SSL Certificate Between Apache Servers

This guide shows you how to copy an SSL certificate from one Apache server to another. It needs root access on both servers.

Domains and DNS2 min read7 steps1 screenshots

What is an SSL certificate?

SSL makes a website safe, so the address starts with https://. A certificate is like an ID card for your site. It comes with a secret private key. The key proves the certificate is yours. You need both to move a certificate. There is often a third file, called the chain or CA bundle. It links your certificate to the company that issued it.

Warning: The private key is a secret. Never email it or put it where others can read it. Use a safe copy method like SCP, and delete stray copies afterwards.

Files you need

FileCommon name
Certificateyourdomain.crt
Private keyyourdomain.key
Chain (CA bundle)ca-bundle.crt

The names and paths on your server may differ. Look in your Apache config for lines starting with SSLCertificateFile, SSLCertificateKeyFile and SSLCertificateChainFile.

Steps

  1. On the old server, find the file paths.
grep -ri "SSLCertificate" /etc/httpd /etc/apache2 2>/dev/null

This searches the Apache config for the file paths.

  1. Copy the files to the new server using SCP. SCP is a secure way to copy files over SSH.
scp yourdomain.crt yourdomain.key ca-bundle.crt root@NEW_SERVER_IP:/root/

This sends the three files to the new server's /root folder.

  1. On the new server, move the files to a safe folder.
mkdir -p /etc/ssl/yourdomain
mv /root/yourdomain.* /root/ca-bundle.crt /etc/ssl/yourdomain/
chmod 600 /etc/ssl/yourdomain/yourdomain.key

This stores them and makes the key readable only by its owner.

  1. Edit the Apache virtual host for your site. A virtual host is the block of settings for one website.
  2. Add or update these lines inside the SSL block.
SSLEngine on
SSLCertificateFile /etc/ssl/yourdomain/yourdomain.crt
SSLCertificateKeyFile /etc/ssl/yourdomain/yourdomain.key
SSLCertificateChainFile /etc/ssl/yourdomain/ca-bundle.crt

These tell Apache where the files are.

  1. Test the config.
apachectl configtest

This should print Syntax OK.

  1. Restart Apache.
systemctl restart httpd

This applies the change. On Debian and Ubuntu, use apache2.

Check it

Open your site with https://. Click the padlock to see the certificate details. If you see an error about the key not matching, the wrong key was copied.

Quick recap

  • You need the certificate, the private key and the chain file.
    rawssl
  • Copy them safely with SCP.
  • Set key permission to 600.
  • Point Apache at the files, test, then restart.
  • Remove stray copies afterwards.