Hi @raimanau,

It’s my pleasure to answer your question.I can’t see what’s wrong with your configuration,so if you don’t mind,I want to tell you the whole steps to deploy SSL on apache.

First you need to get your cert,which should be like this:

1_root_bundle.crt    # root ca & middle ca
2_xxx.xxx.xxx.crt # domain cert
3_xxx.xxx.xxx.key # private key

You said you didn’t receive your middle ca,and I know what you have experienced.You can download your middle ca on this site:
https://certificatechain.io/
This tool work when your cert chain is broken.So now please just deploy the cert with middle ca,we will fix it soon.

Then,it’s time to config the 000-default.conf file.
In the /etc/apache2 directory, there are two related directories sites-available and sites-enable.dWe can find under the sites-enabled directory, there is a file 000-default.conf. Actually this is a soft link with sites-ssl/000-default.conf file.We need to configure another SSL certificate. We need to rely on another file, which is default-ssl.conf. First, we need to set a soft link and link this file to the sites-enabled folder:

ln -s /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-enabled/000-default-ssl.conf

Then modify this file 000-default-ssl.conf, because a soft link has already been made, in fact, modifying 000-default-ssl.conf or default-ssl.conf is the same.

This file looks like this before it was modified (after removing its own comments):

<IfModule mod_ssl.c>
    <VirtualHost _default_:443>
        ServerAdmin webmaster@localhost

        DocumentRoot /var/www/html

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        SSLEngine on

        SSLCertificateFile  /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                SSLOptions +StdEnvVars
        </Directory>

    </VirtualHost>
</IfModule>

Then transfer the certificate (3 files) downloaded to your customized directory.Then we need to modify it to this:

<IfModule mod_ssl.c>
    <VirtualHost _default_:443>
        ServerAdmin add your mail here

        DocumentRoot /var/www/ # where your site is located
        ServerName add your domain here

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        SSLEngine on
        # Attention,you need to add these three lines:
        SSLCertificateFile custom cert path/2_xxx.xxx.xxx.crt
        SSLCertificateKeyFile custom cert path/3_xxx.xxx.xxx.key
        SSLCertificateChainFile custom cert path/1_root_bundle.crt

        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                SSLOptions +StdEnvVars
        </Directory>
    </VirtualHost>
</IfModule>

Save it after changing it.

Then, we load the Apache2 SSL module:

sudo a2enmod ssl   #load
sudo service apache2 restart# restart

At this point, enter https:// in your browser and your domain name should already be able to access the site through https. At this time, the browser should already have a small green lock.

But … this is not enough, because if we do not actively enter https://, if we enter the domain name directly, we will directly jump to the ordinary http access of port 80, so we need to force the use of https to access.

We just need to open the file /etc/apache2/sites-available/000-default.conf and add three lines to any place in your <VirtualHost *: 80> tag:

RewriteEngine on
RewriteCond   %{HTTPS} !=on
RewriteRule   ^(.*)  https://%{SERVER_NAME}$1 [L,R]

Then save and start the redirection of Apache2

 sudo a2enmod rewrite

then

sudo service apache2 restart

Now you can visit your site with https://,but you will receive the note ‘a broken cert chain’ from browser.So we can go to the site I mentioned above and type in your domain to get the full cert chain.Then what should you do?Modify the chain file in the custom cert path from a broken one to a new one you get just now.Then

sudo service apache2 restart

DONE!

If there are still any other questions,welcome to reply to this answer and I will try me best to help you.

よかれと祈りつつ！
Shiroka

Sorry,I have typed some wrong words for I want to help you as fast as I can.Now I have to note them.

1. In the paragraph with the only link of a cert tool,you can find this: So now please just deploy the cert with middle ca,we will fix it soon. This should be changed to this: So now please just deploy the cert without middle ca,we will fix it soon.

2. In the next paragraph,which is below the paragraph mentioned,I talked In the /etc/apache2 directory, there are two related directories sites-available and sites-enable.d.However,there is no d.So the right one can be: In the /etc/apache2 directory, there are two related directories sites-available and sites-enable.

Kind regards,
Shiroka