Enterprise SysAdmin Guide

How to Implement HTTPS on Ubuntu with Apache2 & Let's Encrypt

A comprehensive, conceptual, step-by-step walkthrough designed to secure any web service from unencrypted HTTP (Port 80) to military-grade TLS/SSL (Port 443) with zero-downtime automated certificate renewal.

💡 Important Note for Implementing on Your Own Server:
Throughout this tutorial, web.docbyperfect.com is used as our live demonstration domain. When you run these commands on your server, simply replace web.docbyperfect.com with your own registered domain name (e.g., yourdomain.com or api.yourdomain.com).

Deployment Protocol & Architecture Walkthrough

Each step explains the exact rationale, the system package used, and the underlying network mechanics.

0 Phase 0: Prerequisites & DNS Boundary Check

⚡ Privilege Notice: The commands in this section should be executed with root/sudo privileges (e.g. prefix with sudo or run in a sudo -i root shell).

Why this step is critical: Let's Encrypt (the Certificate Authority) issues SSL certificates using the ACME protocol. To prove you actually own your domain, their servers will query public DNS for your domain name and attempt an HTTP handshake to your server's Public IP. If your DNS 'A' record is not propagated, validation fails immediately.

dig +short web.docbyperfect.com

Why update the system? Updating the APT repository indices ensures that when we install Apache and Snap, we pull patched packages with zero known vulnerabilities.

apt update && apt upgrade -y

1 Phase 1: Web Engine (Apache2) & Firewall Lockdown

⚡ Privilege Notice: The commands in this section should be executed with root/sudo privileges.

Package: apache2 — The battle-tested HTTP server engine. We install Apache, register it as a systemd background service, and verify it automatically launches upon server reboot.

apt install apache2 -y
systemctl enable apache2
systemctl start apache2

Why UFW configuration is needed: Ubuntu's Uncomplicated Firewall (UFW) drops unauthorized incoming connections by default. We must explicitly open Port 22 (SSH) so you don't get locked out, Port 80 (HTTP) for ACME domain verification challenges, and Port 443 (HTTPS) for encrypted traffic.

ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
ufw status verbose

Document Root Isolation: Rather than dumping files into the default /var/www/html, modern multi-site architecture isolates each domain into its own folder (e.g., /var/www/YOUR_DOMAIN/html) so multiple applications can run cleanly on one server.

mkdir -p /var/www/web.docbyperfect.com/html
chown -R $USER:$USER /var/www/web.docbyperfect.com/html

VirtualHost Configuration: A VirtualHost tells Apache: *"When an HTTP request arrives on Port 80 asking for this specific domain name, serve files from this specific directory."*

nano /etc/apache2/sites-available/web.docbyperfect.com.conf

<VirtualHost *:80>
    ServerName web.docbyperfect.com
    ServerAdmin admin@docbyperfect.com
    DocumentRoot /var/www/web.docbyperfect.com/html

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Site Activation: a2ensite creates a symbolic link from sites-available to sites-enabled. We also disable the default Ubuntu welcome site (000-default.conf) to eliminate routing conflicts.

a2ensite web.docbyperfect.com.conf
a2dissite 000-default.conf
apachectl configtest
systemctl reload apache2

2 Phase 2: Certbot Installation & Automated ACME SSL Issuance

⚡ Privilege Notice: The commands in this section should be executed with root/sudo privileges.

Package: certbot via Snap — Canonical and the Electronic Frontier Foundation (EFF) recommend installing Certbot via Snap rather than APT. Snap provides automatic background updates so your cryptographic client always supports the latest cipher suites and TLS 1.3 standards.

apt install snapd -y
snap install core && snap refresh core
snap install --classic certbot
ln -sf /snap/bin/certbot /usr/bin/certbot

What certbot --apache actually does: Certbot contacts Let's Encrypt, completes the HTTP-01 challenge by temporarily dropping a cryptographic token into your web root, receives the signed certificate pair (fullchain.pem and privkey.pem), creates an SSL configuration on Port 443, and configures an automatic 301 redirect from HTTP to HTTPS!

certbot --apache -d web.docbyperfect.com

Automated 90-Day Renewal: Let's Encrypt certificates expire every 90 days to limit the blast radius of a compromised key. Certbot installs a systemd timer that checks twice daily for expiring certificates. The --dry-run flag simulates a real renewal without modifying production files.

certbot renew --dry-run

3 Phase 3: Configuration Hygiene & DocumentRoot Locking

⚡ Privilege Notice: The commands in this section should be executed with root/sudo privileges.

Why this step is necessary: In some environments, Certbot attaches the SSL directives to the default configuration (000-default-le-ssl.conf). If left uncleaned, visitors to HTTPS might see the generic "Apache2 Ubuntu Default Page" instead of your actual project. We rename and align the configuration to point strictly to your custom document root.

mv /etc/apache2/sites-available/000-default-le-ssl.conf /etc/apache2/sites-available/web.docbyperfect.com-le-ssl.conf

Check Configuration Paths: Ensure your SSL VirtualHost file includes your ServerName, your exact DocumentRoot /var/www/YOUR_DOMAIN/html, and the paths to your Let's Encrypt fullchain.pem and privkey.pem files.

a2dissite 000-default.conf
a2dissite 000-default-le-ssl.conf 2>/dev/null
a2ensite web.docbyperfect.com-le-ssl.conf
apachectl configtest
systemctl reload apache2

4 Phase 4: Edge Verification & Protocol Auditing

⚡ Privilege Notice: The commands in this section can be run as any standard user.

Verifying Permanent Redirection (HTTP 301): When a client sends a request to unencrypted http://, the server must respond with HTTP/1.1 301 Moved Permanently pointing to https://. This proves unencrypted data is never served.

curl -I http://web.docbyperfect.com

Verifying TLS Handshake (HTTP 200 OK): Inspecting the HTTPS URL over Port 443 must return HTTP/1.1 200 OK or HTTP/2 200 OK with valid SSL cipher parameters.

curl -I https://web.docbyperfect.com

Auditing Certificate Validity: Review active certificate expiration dates and inspect the systemd timers to ensure the automated renewal loop is alive.

certbot certificates
systemctl list-timers | grep certbot

The Engineering Story: In modern networks, unencrypted HTTP (Port 80) exposes user sessions, auth headers, and data payloads to eavesdropping and man-in-the-middle tampering. To guarantee absolute confidentiality and data integrity, our server was upgraded directly to enforced TLS encryption. By deploying Apache2 alongside Let's Encrypt automated ACME challenges, web.docbyperfect.com successfully achieves military-grade security with automated 90-day zero-downtime certificate renewals.

Live Server Verification & Diagnostics

Proof of live operational status retrieved directly from the hosting environment.

ACTIVE TELEMETRY HUD LATENCY: measuring...

Traffic Encryption

Scanning...

Target Endpoint

...

Transfer Protocol

...

Node Integrity

200 OK

Static Hostname	web.docbyperfect.com
Operating System	Ubuntu 26.04.1 LTS
Kernel Release	Linux 7.0.0-42-generic
Architecture & Virtualization	x86-64 • KVM (Hypervisor)
Machine ID	5dae2dafeb5548499eb8fec57022e217
Hardware & Chassis	VM (QEMU Standard PC i440FX)
Assigned Public IP	103.92.216.34

Implemented By

Infrastructure configuration and security deployment successfully executed by:

Md. Mamun Or Rashid

Md. Nabil Hossain