Automating SSL/TLS Certificate Renewals in Apache

In short: to automate SSL/TLS certificate renewal in Apache with ITVA, issue the certificate with a key generated on the server. Then add an SSH install that copies the key and certificate into place and runs apachectl -k graceful. Last, turn on Auto Renew.

This guide sets up hands-off certificate renewal for Apache HTTP Server on Linux. When you finish, ITVA renews the certificate before it expires, installs the new certificate and key on the server, and runs a graceful reload. Apache finishes open requests on the old certificate and serves new connections with the new one.

For how installs work in general, see How certificate installs work.

Before you begin

• Add the Apache server to ITVA as a device with SSH credentials and a probe. See Add your first device.
• Make sure the SSH account can run sudo cp and sudo apachectl without a password prompt. The install script runs without a terminal, so it cannot answer a prompt.
• Create an enrollment for the site, with an enabled CA template. See Set up certificate templates.
• Find the certificate and key paths in your Apache virtual host. This guide uses the paths below. Change them to match your server.

SSLCertificateFile    /etc/ssl/certs/server-rsa.pem
SSLCertificateKeyFile /etc/ssl/private/server-rsa.key

Step 1: Issue the certificate with a key generated on the server

Generate the key on the Apache server so that it never leaves the server. ITVA then creates a new key at the same path at each renewal.

1. Open the enrollment and select Issue.
2. Select Generate on Device.
3. In Device, select the Apache server.
4. In Private Key Path, type .itva/apache-key.key. A relative path starts in the home folder of the SSH account. ITVA creates the folder if it does not exist.
5. In Private Key Algorithm, select an algorithm that the CA template allows, for example RSA 2048.
6. Submit the request and wait for the certificate to issue.

The key file is not encrypted, because Apache must read it at startup without a passphrase. The SSH account owns it. The install script copies it to the protected folder that Apache uses.

Step 2: Add an install with the Apache reload script

1. On the Installs card of the enrollment, select Install.
2. In Format, select OpenSSL - PEM.
3. Keep Include private key off. The key is already on the server.
4. Turn on Include certificate chain. Apache 2.4.8 and later read the intermediate certificates from SSLCertificateFile, so browsers get the full chain.
5. Make sure Auto Install is on.
6. Select SSH. In Device, select the Apache server.
7. In Path, type .itva/apache-cert.pem. The probe writes the certificate here.
8. In Script, paste the script below. Change the destination paths to match your virtual host.

sudo cp .itva/apache-key.key /etc/ssl/private/server-rsa.key
sudo cp {{PATH}} /etc/ssl/certs/server-rsa.pem
sudo apachectl -k graceful

9. Select Save. ITVA installs the current certificate immediately.

The script does three things:

• Copies the key that ITVA generated on the server to the path in SSLCertificateKeyFile.
• Copies the new certificate to the path in SSLCertificateFile. ITVA replaces {{PATH}} with the value of Path before it runs the script.
• Reloads Apache gracefully. Open connections finish, and new connections get the new certificate. There is no downtime.

To stop a broken configuration from taking the site down, you can test the configuration before the reload. Use this last line instead:

sudo apachectl configtest && sudo apachectl -k graceful

If the test fails, the reload does not run, Apache keeps serving the old certificate, and the install job fails with the error.

Step 3: Turn on auto renew

1. Open the enrollment.
2. Turn on the Auto Renew switch.

By default, ITVA renews the certificate 14 days before it expires.

What happens at each renewal

1. ITVA generates a new key and CSR on the Apache server, at .itva/apache-key.key. Apache keeps using its own copy in /etc/ssl/private, so the site is not affected.
2. The issuer signs the CSR and returns the new certificate.
3. The probe writes the certificate to .itva/apache-cert.pem.
4. The script copies the new key and certificate into place together and reloads Apache.

Check that it worked

1. On the Installs card, make sure the latest job has the status Completed.
2. From any computer that can reach the site, check the certificate that Apache serves. Replace <HOSTNAME> with the name of the site.

echo | openssl s_client -connect <HOSTNAME>:443 -servername <HOSTNAME> 2>/dev/null | openssl x509 -noout -subject -serial -enddate

3. Make sure the serial number and expiry date match the latest certificate of the enrollment.

To test the full flow without waiting for a renewal, select Reinstall on the install.

Caution: if the last renewal failed, do not select Reinstall. The renewal may have replaced the key at .itva/apache-key.key without issuing a certificate for it. Fix the cause and renew again first.

Troubleshooting