Comment créer un certificat SSL auto-signé pour Apache dans Ubuntu 20.04

A self-signed SSL certificate encrypts traffic between a web server and clients but is not validated by a trusted Certificate Authority (CA). It is ideal for testing HTTPS configurations (e.g., in development environments) or securing internal services where external trust is unnecessary. This guide walks you through generating a self-signed SSL certificate and configuring Apache on Ubuntu 20.04.

Table of Contents#

Prerequisites#

  1. Ubuntu 20.04 Server: Ensure your system is up-to-date: 
    sudo apt update && sudo apt upgrade -y
  2. Apache Web Server: Install Apache (if not already installed): 
    sudo apt install apache2 -y
  3. OpenSSL: Verify it is installed (usually pre-installed): 
    openssl version
  4. Administrative Privileges: Use sudo for commands requiring root access.

Step 1: Generate a Self-Signed SSL Certificate#

We use OpenSSL to create a private key, a Certificate Signing Request (CSR), and the self-signed certificate.

1.1 Create a Private Key#

First, create a directory to store SSL files (e.g., /etc/apache2/ssl):

sudo mkdir -p /etc/apache2/ssl
sudo chmod 700 /etc/apache2/ssl  # Restrict access

Generate a 2048-bit RSA private key (4096-bit is more secure but slower):

sudo openssl genrsa -out /etc/apache2/ssl/example.com.key 2048

1.2 Create a Certificate Signing Request (CSR)#

A CSR contains your server’s details (e.g., domain, organization). Run:

sudo openssl req -new -key /etc/apache2/ssl/example.com.key -out /etc/apache2/ssl/example.com.csr

You will be prompted to enter details (e.g., country, state, domain). For a self-signed cert, values can be dummy, but ensure:

  • Common Name (CN): Matches your server’s domain (e.g., example.com or localhost).

1.3 Generate the Self-Signed Certificate#

Create the certificate (valid for 365 days; adjust -days as needed):

sudo openssl x509 -req -days 365 -in /etc/apache2/ssl/example.com.csr -signkey /etc/apache2/ssl/example.com.key -out /etc/apache2/ssl/example.com.crt

Step 2: Configure Apache to Use the SSL Certificate#

2.1 Enable the SSL Module#

Enable Apache’s SSL module (and headers for optional security headers like HSTS):

sudo a2enmod ssl
sudo a2enmod headers  # Optional (for HSTS)

2.2 Create/Edit the SSL Virtual Host Configuration#

Create a new virtual host file (e.g., example.com-ssl.conf) in /etc/apache2/sites-available/:

sudo nano /etc/apache2/sites-available/example.com-ssl.conf

Add this configuration (replace example.com with your domain):

<VirtualHost *:443>
    ServerAdmin [email protected]
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/html
 
    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/example.com.crt
    SSLCertificateKeyFile /etc/apache2/ssl/example.com.key
 
    # Optional: HSTS Header (Enhances Security)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
 
    <Directory /var/www/html>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
 
    ErrorLog ${APACHE_LOG_DIR}/example.com-ssl_error.log
    CustomLog ${APACHE_LOG_DIR}/example.com-ssl_access.log combined
</VirtualHost>

2.3 Adjust File Permissions#

Ensure Apache (user www-data) can read the certificate and key:

sudo chown root:www-data /etc/apache2/ssl/*
sudo chmod 640 /etc/apache2/ssl/example.com.key  # Readable by root and www-data
sudo chmod 644 /etc/apache2/ssl/example.com.crt  # Readable by all (safe for cert)

2.4 Enable the SSL Site & Restart Apache#

Enable the new virtual host:

sudo a2ensite example.com-ssl.conf

Restart Apache to apply changes:

sudo systemctl restart apache2

Step 3: Test the SSL Configuration#

3.1 Using a Web Browser#

Navigate to https://example.com (replace with your domain). You will see a “Your connection is not private” warning (normal for self-signed certs). Click “Advanced” → “Proceed to example.com” to access the site.

3.2 Using curl#

Test via the command line (use -k to skip certificate validation):

curl -k -v https://example.com

Look for:

  • SSL connection using ... (confirms encryption).
  • Server certificate: (shows your self-signed cert details).

Best Practices for Self-Signed Certificates#

  1. Key Length: Use 2048-bit (or 4096-bit) keys for security.
  2. Validity Period: Limit to 1 year (365 days) to reduce risk of expired certs.
  3. Non-Production Use: Only use self-signed certs in development/testing. For production, use Let’s Encrypt (free) or a commercial CA.
  4. Security Headers: Add HSTS (Strict-Transport-Security) to force HTTPS (optional but recommended).

Troubleshooting Common Issues#

  • Apache Fails to Start: Check logs (sudo tail /var/log/apache2/error.log) for:
    • Invalid file paths (e.g., wrong certificate/key location).
    • Permission errors (e.g., key file not readable by www-data).
    • Syntax errors in virtual host config.
  • Browser Warning: Ensure the domain matches the certificate’s Common Name (CN).
  • Port 443 Blocked: Verify UFW (firewall) allows HTTPS: 
    sudo ufw allow 443/tcp

Conclusion#

Self-signed SSL certificates are a quick way to test HTTPS in non-production environments. This guide covered generating a cert, configuring Apache, and testing the setup. For production, use Let’s Encrypt (free) or a trusted CA to avoid browser warnings.

References#

2026-05