I am using Let's Encrypt (certonly) to generate SSL certificates for several websites hosted on an Apache server. The file location of these certificates is determinate before they are created, so I am writing their paths into my virtual host configuration in advance. Once the site is running, I will use certbot to get the certificate files and then reload the Apache configuration.

I also have a global SSL certificate defined with valid files, so every SSL virtual host will be certain to have a certificate.

The problem I'm having is that Apache won't run without all the certificate files, despite having a global fallback. I tried to conditionally configure the Let's Encrypt certificate only when the file exists using IF, but Apache says SSLCertificateFile not allowed here.

How might I override the global SSLCertificateFile only when the new certificate files exist? I'm trying to do all of this without having to modify the configuration before and after the certificates have been generated.

Here is what I tried:

<If "-f '/etc/letsencrypt/live/domain/fullchain.pem'">
  SSLCertificateFile /etc/letsencrypt/live/domain/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/domain/privkey.pem

→ SSLCertificateFile not allowed here

  • Simply deploy a dummy file there that you can let certbot overwrite? – HBruijn Apr 26 '17 at 6:25

In this case, I would create a directory of symlinks for each domain, and use the server's snakeoil cert (or your previously mentioned "global" certificate) for domains you don't have configured yet. For example:

$ ls -1 /etc/ssl/domains
example.com/fullchain.pem -> /etc/letsencrypt/live/example.com/fullchain.pem
example.com/privkey.pem -> /etc/letsencrypt/live/example.com/privkey.pem
second-example.com/fullchain.pem -> /etc/ssl/certs/ssl-cert-snakeoil.pem
second-example.com/privkey.pem -> /etc/ssl/private/ssl-cert-snakeoil.key

You can then set the Apache directives to use the symlink directory:

SSLCertificateFile /etc/ssl/domains/example.com/fullchain.pem
SSLCertificateKeyFile /etc/ssl/domains/example.com/privkey.pem

This has the advantage of only needing to replace the symlink when you generate a Let's Encrypt certificate for the domain, however users visiting the domain before a full certificate is installed will receive warnings as the snakeoil certificate is self-signed.

  • Brilliant and much appreciated. – Nathan Apr 26 '17 at 10:47

Another idea: if I understood correctly, you have global virtualhost as a catchall and then other virtualhosts, one per website. If the website has not yet the associated SSL certificate, then it should not be configured at all. You can put each website configuration in its own file, and have 2 directories: sites-enabled and sites-waiting with an Apache configuration saying to include everything from sites-enabled. When your website is configured (meaning it has its SSL certificate) you just need to move its configuration from one directory to another, and reload Apache.

This kind of setup is done by various Linux distributions.

  • The non-SSL configuration has to be enabled to obtain the certificate. Typically I keep both the non-SSL and SSL configurations in the same file, but if I split them up this scheme could work. Thanks! – Nathan Apr 30 '17 at 1:38

Actually I have the .well-known alias in the same directory for all virtualhosts. This way the challenge is reachable via the default virtualhost when the new virtualhost is not enabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.