Skip to content
Docs sslbrain sslbrain.com

Apache HTTP Server

Copy link to the page “Apache HTTP Server”

← All integrations

Linux · Web server

Finds loaded TLS VirtualHosts and replaces the selected RSA or ECDSA certificate with a checked reload.

The service agent on the server fetches the task from the appliance over outbound HTTPS on port 443 and installs the certificate locally on the server. The appliance never connects to the server.

What happens

  1. The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
  2. Discovery finds loaded VirtualHosts and their ordered certificate and key slots. Select the paths for the RSA or ECDSA slot to replace.
  3. The certificate and key are validated and staged beside the target files. Known key conflicts are refused before changes; previous files are protected for recovery.
  4. The files are switched, configuration is checked and Apache is reloaded. Recovery occurs only when the previously working service is observed broken after the switch. A running service reloads the restored files; only a stopped service is started.
  5. Verification uses the service parent process and local TLS responses for the selected slot. An accepted reload without sufficient evidence is reported with a warning.

Technical details

Connection
The package runs through the service agent on the server. The agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
Service ports
443, 80
You need
The service agent installed on the server. An SSH account that can read loaded configuration and certificates, write the selected files and their directories, and run fixed configtest, reload and start commands through scoped sudo.
Platform
Apache 2.4 and later
Actions
Discovery, Installation, Verification; no rollback action
Packages
apache-ssh 1.4.1
Note
  • Discovery asks the running Apache where its configuration is: the process's -f and -d, else the systemd unit, else apache2 -V or httpd -V. Include and IncludeOptional are followed. Deploy also accepts files outside the standard folders when a VirtualHost in the live configuration uses exactly those files.
  • SSH login supports a password or private key. File writes run as this account; sudo permits only fixed service commands. Unknown loaded configuration is marked incomplete.
  • Local TLS host, port and SNI fields are optional; otherwise known loaded listeners are used. RELOAD=false writes files only and warns that activation is unverified. Deployment checks intermediate presence; verify reports chain trust and name matching separately. Unverified activation does not block a later renewal, while unresolved recovery is reported as an error.
  • For a mod_md managed name, optional TARGET_SERVER_NAME selects takeover. The certificate must cover all names; only the selected declaration switches to static files and manual renewal. The account must be able to write the configuration file and its directory. Other managed names are preserved. Renewing existing static mod_md files needs no configuration change.
  • Alpine/musl and BusyBox environments support the same selected certificate paths. Install Bash, OpenSSL, GNU coreutils and util-linux flock; BusyBox does not replace Bash. Path length and allowed characters are checked on Alpine too.

Get started