I have an apache server running that required a minor configuration update. I want to force Apache to reload the config (e.g. via /etc/init.d/httpd reload or apachectl graceful), but I do not posses our SSL cert passwords. The admin who has the passwords is not available right now.

If I gracefully reload the apache config, will the SSL certificates need the password again? Or does that only happen during a full restart of the server?


No. SSL certificates are only reloaded on a full restart, not a graceful one.

This means you won't need to re-enter the password on a reload/graceful, and also means that changes to the certificates/new certificates/etc require a full restart to take effect.

| improve this answer | |
  • 6
    I don't know if anything has changed, but at least on httpd 2.4.20, apachectl graceful as well as SIGHUP do cause a reload of SSL certificates. – rustyx Aug 9 '16 at 11:35
  • 1
    A graceful restart is not the same as a reload. The former just waits for all child processes to exit gracefully before restarting. – Dennis Feb 12 '17 at 21:33
  • 1
    @Dennis They are the same; "/etc/init.d/apache2 reload" runs "apachectl -k graceful". – Nicolás Mar 11 '18 at 1:23

Because there is a bit of confusion about full restart and graceful restart I must say that

apachectl restart

Fully restarts the server but that is not gracefully done. This means that current connections are aborted.

What you want to achieve can be done gracefully with:

apachectl graceful

Both methods reload the certificates.

Which does a full apache restart, but the active connections are not aborted. It does not accept new connections until the current ones finish processing and restarts after that.

In conclusion, both restart and graceful do a full apache restart, but graceful does not abort connections, waits for them to be closed, then it restarts.

| improve this answer | |
  • 1
    And to answer the question, it seems that apachectl graceful does reload the certificates – at least it did in my case (though my certificates are not password-protected). – Lucas Werkmeister Jul 12 '18 at 10:41

Make sure you actually changed something.

Find the location of the certificate in your webserver-config. Mine is here: /etc/apache2/sites-enabled/ssl.conf

It looks like this on my box:

SSLCertificateFile      /etc/ssl/certs/example.de.pem

Inspect the certificate with openssl x509 -text -in /etc/ssl/certs/example.de.pem and check if that is actually the certificate that you want.

I had to swap the cert because it would become invalid soon and I replaced the old cert with a copy of the same old cert. That would obviously not change anything and I ended up here.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.