Configure Apache HTTP/2 and SSL termination with Let's Encrypt certificates

Intermediate 25 min Apr 28, 2026 490 views
Ubuntu 24.04 Debian 12 AlmaLinux 9 Rocky Linux 9

Set up Apache HTTP Server with HTTP/2 protocol support and automatic SSL certificate management using Certbot. This tutorial covers virtual host configuration, SSL termination, and performance optimization for production websites.

Prerequisites

  • Root or sudo access
  • Domain name pointing to your server
  • Port 80 and 443 open in firewall

What this solves

Apache HTTP Server with HTTP/2 provides faster page loading through request multiplexing and server push capabilities. SSL termination handles HTTPS encryption at the web server level, offloading cryptographic work from backend applications. Let's Encrypt certificates provide free, automated SSL/TLS encryption that renews automatically.

Step-by-step configuration

Update system packages

Start by updating your package manager to ensure you get the latest Apache version with HTTP/2 support.

sudo apt update && sudo apt upgrade -y
sudo dnf update -y

Install Apache and SSL modules

Install Apache HTTP Server with essential SSL and HTTP/2 modules. The installation includes mod_ssl for SSL termination and mod_http2 for HTTP/2 protocol support.

sudo apt install -y apache2 apache2-utils
sudo a2enmod ssl
sudo a2enmod http2
sudo a2enmod headers
sudo a2enmod rewrite
sudo dnf install -y httpd httpd-tools mod_ssl
sudo systemctl enable httpd

Install Certbot for Let's Encrypt certificates

Certbot automates the process of obtaining and renewing Let's Encrypt SSL certificates. Install the Apache plugin for seamless integration.

sudo apt install -y certbot python3-certbot-apache
sudo dnf install -y certbot python3-certbot-apache

Configure main Apache settings

Update the main Apache configuration to enable HTTP/2 globally and optimize performance settings. This configuration enables HTTP/2 for all SSL-enabled virtual hosts.

# Enable HTTP/2 protocol
Protocols h2 h2c http/1.1

# HTTP/2 performance settings
H2MaxSessionStreams 100
H2InitialWindowSize 65536
H2MaxFrameSize 16384
H2StreamMaxMemSize 65536

# Enable HTTP/2 server push
H2Push on
H2PushPriority *                     after
H2PushPriority text/css              before
H2PushPriority image/jpeg            after   32
H2PushPriority application/javascript interleaved
sudo a2enconf http2

Create virtual host configuration

Set up a virtual host that will handle both HTTP and HTTPS traffic. This configuration redirects HTTP to HTTPS and prepares for SSL certificate installation.

Create document root directory

Create the web directory with proper ownership and permissions. The www-data user needs read access to serve files, and you need write access to manage content.

sudo mkdir -p /var/www/example.com
sudo chown -R $USER:www-data /var/www/example.com
sudo chmod -R 755 /var/www/example.com
Never use chmod 777. It gives every user on the system full access to your files. Instead, use 755 for directories (owner can read/write/execute, group and others can read/execute) and proper ownership with chown.

Create a test page

Add a simple HTML page to test the configuration. This page includes HTTP/2 server push directives for optimal performance.




    
    
    
    


    <h1>Apache HTTP/2 with SSL</h1>
    <p>This site is running on Apache with HTTP/2 and Let's Encrypt SSL certificates.</p>
    <p>Protocol: <span></span></p>
    


body {
    font-family: Arial, sans-serif;
    max-width: 800px;
    margin: 0 auto;
    padding: 20px;
    background-color: #f4f4f4;
}

h1 {
    color: #333;
    text-align: center;
}

p {
    line-height: 1.6;
    color: #666;
}

Enable the virtual host

Activate the virtual host configuration and enable required Apache modules for optimal performance.

sudo a2ensite example.com.conf
sudo a2enmod deflate
sudo a2enmod expires
sudo apache2ctl configtest
sudo systemctl reload apache2
sudo httpd -t
sudo systemctl restart httpd

Configure firewall

Open HTTP and HTTPS ports in the firewall. Port 80 is needed for Let's Encrypt validation, and port 443 for HTTPS traffic.

sudo ufw allow 'Apache Full'
sudo ufw status
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Obtain Let's Encrypt SSL certificates

Use Certbot to automatically obtain and install SSL certificates. This command will modify your Apache configuration to include the SSL certificate paths and enable HTTPS.

sudo certbot --apache -d example.com -d www.example.com
Note: Certbot will prompt for an email address and agreement to terms of service. It automatically configures SSL settings and certificate paths in your Apache virtual host.

Optimize SSL configuration

Update the SSL configuration for enhanced security and performance. This includes modern cipher suites and SSL protocols.

# SSL Protocol support
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off
SSLSessionTickets off

# OCSP Stapling
SSLUseStapling On
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

# SSL Compression
SSLCompression off

# Performance optimizations
SSLSessionCache "shmcb:logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
sudo a2enconf ssl-params
sudo systemctl reload apache2

Set up automatic certificate renewal

Configure automatic renewal of Let's Encrypt certificates. Certificates expire every 90 days and must be renewed regularly.

sudo crontab -e

Add this line to run renewal checks twice daily:

0 12,0 * * * /usr/bin/certbot renew --quiet --post-hook "systemctl reload apache2"

Test the renewal process:

sudo certbot renew --dry-run

Configure HTTP/2 server push

Add HTTP/2 server push directives to preload critical resources. This improves page load performance by pushing resources before the browser requests them.

# HTTP/2 Server Push


# Compression for text files

Verify your setup

Test your Apache HTTP/2 and SSL configuration with these verification commands:

# Check Apache status and loaded modules
sudo systemctl status apache2
sudo apache2ctl -M | grep -E "(ssl|http2|headers)"

# Test SSL certificate
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

# Check HTTP/2 protocol support
curl -I -k --http2 https://example.com

# Test certificate renewal
sudo certbot certificates

# Verify virtual host configuration
sudo apache2ctl -S

Visit your domain in a web browser and check the developer tools Network tab to confirm HTTP/2 protocol usage. Look for "h2" in the Protocol column.

Performance optimization

Enable mod_pagespeed (optional)

Google's mod_pagespeed automatically optimizes web pages and resources. Install it for additional performance improvements.

wget -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
echo "deb [arch=amd64] http://dl.google.com/linux/mod-pagespeed/deb/ stable main" | sudo tee /etc/apt/sources.list.d/mod-pagespeed.list
sudo apt update
sudo apt install -y mod-pagespeed-stable
sudo systemctl restart apache2
wget https://dl-ssl.google.com/dl/linux/direct/mod-pagespeed-stable_current_x86_64.rpm
sudo dnf install -y mod-pagespeed-stable_current_x86_64.rpm
sudo systemctl restart httpd

Configure worker settings

Optimize Apache worker processes for better concurrent connection handling with HTTP/2.

sudo systemctl restart apache2

Common issues

SymptomCauseFix
HTTP/2 not workingmod_http2 not loadedsudo a2enmod http2 && sudo systemctl restart apache2
SSL certificate errorsFirewall blocking port 80sudo ufw allow 80/tcp or check DNS settings
"AH00558" error messageMissing ServerName directiveAdd ServerName example.com to virtual host
Permission denied errorsWrong file ownershipsudo chown -R www-data:www-data /var/www/example.com
Certbot renewal failsApache config syntax errorsudo apache2ctl configtest to check configuration
Browser shows HTTP/1.1SSL not properly configuredCheck certificate installation with sudo certbot certificates

Monitoring and logging

For comprehensive monitoring of your Apache HTTP/2 setup, consider implementing log analysis and performance tracking. You can implement Apache log analysis with GoAccess and ELK stack for real-time monitoring or set up Apache reverse proxy and load balancing for high availability scenarios.

Next steps

Running this in production?

Want this handled for you? Setting this up once is straightforward. Keeping it patched, monitored, backed up and performant across environments is the harder part. See how we run infrastructure like this for European teams.

Automated install script

Run this to automate the entire setup

#apache #http2 #ssl #lets-encrypt #virtual-hosts

Related tutorials

hosting Intermediate

Setup OpenResty load balancing with health checks and automatic failover

Configure OpenResty with upstream backend servers, implement health monitoring, and set up automatic failover for high availability load balancing.

45 min 4 distros 575 views
hosting Intermediate

Configure Apache reverse proxy with caching for microservices

Set up Apache HTTP Server as a reverse proxy with intelligent caching for microservices architectures. This tutorial covers mod_proxy, mod_cache configuration, cache policies, and monitoring for high-performance service delivery.

25 min 4 distros 447 views
hosting Advanced

Implement Apache load balancing with SSL termination and health checks

Configure Apache HTTP Server 2.4 with mod_proxy_balancer for high availability load balancing, SSL termination using Let's Encrypt certificates, and automated backend health monitoring with mod_proxy_hcheck for production environments.

45 min 4 distros 548 views
Browse all tutorials in our complete directory →

Don't want to manage this yourself?

We handle infrastructure for businesses that depend on uptime. Fully managed, with one fixed contact who knows your setup.

You get one fixed contact who knows your setup

Rotterdam 01:25 · reachable in a message, no ticket form

+31 10 477 5362 WhatsApp