It really doesn't matter where you put them as long as you properly protect your private key file(s). The public certificate is public; no protection needed - server privileges or otherwise.
To expand on the answer, I do not use the default location
It's easier for me to keep all mine in a separate area due to backups+other reasons.
For Apache SSL, I keep mine in
/etc/apache2/ssl/private or similar "root area" in
This post is geared toward Ubuntu (Debian) + Apache, but should work on most systems -
Just apply the permissions and update location/path in given config (apache/nginx/etc).
If the SSL key files are protected correctly (directory & files), you will be fine. Note the notes!
sudo mkdir /etc/apache2/ssl
sudo mkdir /etc/apache2/ssl/private
sudo chmod 755 /etc/apache2/ssl
sudo chmod 710 /etc/apache2/ssl/private
chmod 710 supports
ssl-cert group under Ubuntu. (See comments)
Setting permission to
/etc/apache2/ssl/private will also work fine.
Place SSL files:
Put public www ssl certificate(s) along with intermediate certificate(s) in
Put private ssl key(s) in
sudo chown -R root:root /etc/apache2/ssl/
sudo chown -R root:ssl-cert /etc/apache2/ssl/private/
If you do not have ssl-cert group, just use 'root:root' on line above or skip 2nd line.
sudo chmod 644 /etc/apache2/ssl/*.crt
sudo chmod 640 /etc/apache2/ssl/private/*.key
The group permission is set to READ (640) due to Ubuntu ssl-cert group. '600' is fine as well.
Enable the Apache SSL module
sudo a2enmod ssl
Edit any Apache site files and enable
(see last paragraph) *
sudo nano /etc/apache/sites-available/mysiteexample-ssl.conf
sudo a2ensite mysiteexample-ssl
# ^^^^^^^^^^^^^^^^^ <-Substitute your ".conf" filename(s)
Restart Apache2 service
sudo service apache2 restart
sudo systemctl restart apache2.service
Done. Test your new SSL site.
* Again this goes beyond the question, but you can copy the default Apache SSL site configuration file (
sudo cp /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/mysiteexample-ssl.conf) as a good starting point/example of default directives/directories normally used under a simple (Ubuntu/Debian) Apache/SSL 'conf' file. It normally points to a self-signed SSL certificate+key (snakeoil), CA bundles, as well as common directives used for a given SSL site.
After copying, just edit the new .conf file and add/remove/update it as needed with new information/paths above then execute
sudo a2ensite mysiteexample-ssl to enable it.