It really doesn't matter where you put them as long as you properly protect your private key file(s). The public certificate is public; no protection needed - server privileges or otherwise.
To expand on the answer, I do not use the default location
It's easier for me to keep all mine in a separate area due to backups+other reasons.
For Apache SSL, I keep mine in
/etc/apache2/ssl/private or similar "root area" in
This post is geared toward Ubuntu (Debian) + Apache, but should work on most systems.
Just apply the permissions and update location/path in given config (apache/nginx/etc).
This answer also assumes you are NOT using LetsEncrypt/Certbot, or some automated SSL service. You have bought, or created a SSL certificate and have obtained the file bundle.
If the SSL key file(s) are protected correctly (directory & files), you will be fine. Note the notes!
sudo mkdir /etc/apache2/ssl
sudo mkdir /etc/apache2/ssl/private
sudo chmod 755 /etc/apache2/ssl
sudo chmod 710 /etc/apache2/ssl/private
chmod 710 supports
ssl-cert group under Ubuntu. (See comments)
Setting permission to
/etc/apache2/ssl/private will also work fine.
Place SSL files:
Put the public SSL certificate(s) AND intermediate certificate(s) in:
/etc/apache2/ssl (These are
*.crt files, normally)
Put the corresponding private SSL key(s) in:
/etc/apache2/ssl/private (These are
*.key files, or no extension, normally)
Note: LetsEncrypt/Certbot uses the ".pem" extension for all SSL files (public, intermediate chains and private). But, you do not need to move (or protect) those files. They are already in place and protected. Just call them directly in your Apache '.conf'.
Note - If you do not have a ssl-cert group, just skip the 2nd line:
sudo chown -R root:root /etc/apache2/ssl/
sudo chown -R root:ssl-cert /etc/apache2/ssl/private/
sudo chmod 644 /etc/apache2/ssl/*.crt
sudo chmod 640 /etc/apache2/ssl/private/*.key
The group permission for private key(s) is set to READ (640) due to Ubuntu ssl-cert group. Using '600' (owner only control) is the normal permission for private keys and will work fine as well.
Enable the Apache SSL module
sudo a2enmod ssl
Edit any Apache site files and enable
(see last paragraph) *
sudo nano /etc/apache/sites-available/mysiteexample-ssl.conf
sudo a2ensite mysiteexample-ssl
# ^^^^^^^^^^^^^^^^^ <-Substitute your ".conf" filename(s)
Restart Apache2 service
sudo service apache2 restart
sudo systemctl restart apache2.service
Done. Test your new SSL site.
* Again this goes beyond the question, but you can copy the default Apache SSL site configuration file (
sudo cp /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/mysiteexample-ssl.conf) as a good starting point/example of default directives/directories normally used under a simple (Ubuntu/Debian) Apache/SSL 'conf' file. It normally points to a self-signed SSL certificate+key (snakeoil), CA bundles, as well as common directives used for a given SSL site.
After copying, just edit the new .conf file and add/remove/update it as needed with new information/paths above then execute
sudo a2ensite mysiteexample-ssl to enable it. Reload/restart apache2. Test.