Under Ubuntu systems, I personally keep mine in
/etc/apache2/ssl/private or a similar user created area under httpd/apache configuration in
/etc. (The default area is normally
/etc/ssl - see bottom of this answer for more)
sudo mkdir /etc/apache2/ssl
sudo mkdir /etc/apache2/ssl/private
sudo chmod 755 /etc/apache2/ssl
sudo chmod 710 /etc/apache2/ssl/private
You can also use the group 'ssl-cert' for private/ under Ubuntu:
sudo chown -R root:root /etc/apache2/ssl/
sudo chown -R root:ssl-cert /etc/apache2/ssl/private/
( If you do not have ssl-cert group, just use root:root for everything under ssl/ )
Put needed public www ssl certificate(s) (along with any intermediate certificates) in
Put needed private ssl key(s) in
Then set permissions:
sudo chmod 644 /etc/apache2/ssl/*.crt
sudo chmod 640 /etc/apache2/ssl/private/*.key
Then edit any web server '.conf' files and where they point for SSL as needed.
Restart web service.
As mentioned, it really doesn't matter where you put your private key(s) as long as you properly protect them.
NOTE: I do not use the default location /etc/ssl in above example (It's easier for me to keep all mine in a separate area.) You may view ("cat /etc/apache2/sites-available/default-ssl.conf") as a good example of default directories normally used under simple ubuntu apache/ssl install for SSL certificates,keys,bundles,etc, as well as common directives used for a given SSL site. Default /etc/ssl area should already be protected correctly as installed.