Fix the certificate that browsers reject on Apache

Why it matters

The certificate or its chain fails verification for a reason other than expiry, a wrong name or a missing authority, so browsers refuse it. Without a certificate at all, HTTPS cannot work.

The fix

1. Check that a VirtualHost on port 443 has SSLEngine on and a matching certificate and key. The mod_ssl module must be enabled.
2. Test the configuration and reload Apache.

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
</VirtualHost>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash