Host Multiple SSL Domains on Apache: Step-by-Step

This guide shows you how to configure Apache to serve multiple domains, each with its own SSL certificate, on a single server. You’ll learn how to set up separate virtual hosts with individual certificate files and ensure HTTPS works correctly for every domain. Before starting, you should have Apache installed, root or sudo access, and SSL certificates for each domain (either from a CA or self-signed for testing).

What You’ll Need

A server running Apache (2.4.x recommended) with mod_ssl enabled
Root or sudo access to the server
SSL certificate and private key files for each domain (e.g., from Let’s Encrypt, a commercial CA, or self-signed for testing)
DNS records pointing each domain to your server’s IP address
Basic familiarity with the command line and Apache configuration files

Step-by-Step

Enable the necessary Apache modules. Run sudo a2enmod ssl and sudo a2enmod headers (headers is optional but useful for security headers). Restart Apache with sudo systemctl restart apache2 (or sudo service apache2 restart on older systems).
Create a directory for each domain’s SSL files. For example: sudo mkdir -p /etc/apache2/ssl/example.com and sudo mkdir -p /etc/apache2/ssl/example.org. Place the certificate, private key, and chain file (if any) in these directories with clear names like cert.pem, privkey.pem, and chain.pem.
Create a virtual host configuration file for each domain. On Debian/Ubuntu, these go in /etc/apache2/sites-available/. For example, create example.com.conf and example.org.conf. Use a text editor to write the configuration.

Write the configuration for the first domain. A basic SSL virtual host looks like this:

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example.com

    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/example.com/cert.pem
    SSLCertificateKeyFile /etc/apache2/ssl/example.com/privkey.pem
    SSLCertificateChainFile /etc/apache2/ssl/example.com/chain.pem

    <Directory /var/www/example.com>
        Options -Indexes
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

Adjust the paths to match your certificate file names and document root. The SSLCertificateChainFile is optional if your CA provides a chain file; if you have a combined file, you can omit it.

Repeat for the second domain. Create a similar configuration in the same file or a separate file (separate files are cleaner). Change ServerName, DocumentRoot, and the certificate paths accordingly.
Enable the sites and reload Apache. Run sudo a2ensite example.com.conf and sudo a2ensite example.org.conf, then sudo systemctl reload apache2 (or sudo service apache2 reload).
Test the configuration. Open a browser and visit https://example.com and https://example.org. You should see the padlock icon indicating a valid SSL connection. If you get a certificate warning, check that the certificate matches the domain and that the chain is complete.
Set up HTTP to HTTPS redirection (recommended). Create a separate port 80 virtual host for each domain that redirects to HTTPS. For example:
```
<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    Redirect permanent / https://example.com/
</VirtualHost>
```
Do this for all domains to ensure users always use the secure version.
Restart Apache to apply all changes. Use sudo systemctl restart apache2 (or sudo service apache2 restart). Check the error log (/var/log/apache2/error.log) for any SSL-related messages.

Common Mistakes

Using the same certificate for multiple domains. A certificate issued for example.com will not work for example.org unless it’s a wildcard or SAN certificate. Each domain needs its own certificate.
Forgetting to enable mod_ssl. Without it, Apache will ignore SSL directives and may fail to start.
Incorrect file permissions on private keys. Apache needs to read the key file; if it’s owned by another user or has restrictive permissions, Apache may fail to start. Set ownership to root:www-data and permissions to 640.
Not including the chain file. Some browsers may show errors if the intermediate certificate is missing. Always include the chain file if your CA provides one.
Mixing up ServerName and ServerAlias. Ensure ServerName is the primary domain and ServerAlias includes any alternative names like www.

Tips

Use Let’s Encrypt with the certbot tool to automate certificate issuance and renewal. It can even configure the virtual hosts for you with the --apache plugin.
Keep your certificates in a separate directory per domain to avoid confusion.
Use a configuration snippet for common SSL settings (e.g., protocols, ciphers) and include it in each virtual host via Include to avoid repetition.
Test your configuration with apachectl configtest (or apache2ctl -t) before reloading to catch syntax errors.
Consider using a wildcard certificate if you have many subdomains, but note that wildcard certificates do not cover multiple different domains.

Troubleshooting

Apache fails to start after adding SSL virtual hosts. Check the error log for messages like “Cannot load module mod_ssl” or “SSLCertificateFile: file does not exist”. Verify that mod_ssl is enabled and that all file paths are correct.
Browser shows “connection not secure” or “certificate error”. This usually means the certificate doesn’t match the domain, is expired, or the chain is incomplete. Check the certificate details in your browser and compare the CN/SAN with the domain.
HTTPS works for one domain but not the other. Ensure you have separate VirtualHost blocks and that the ServerName matches the domain. Also check that the certificate files for the second domain are readable by Apache.
Redirect loop when visiting the site. This often happens when the HTTP virtual host also has SSL enabled or when the redirect is misconfigured. Ensure the port 80 virtual host only redirects and does not contain SSL directives.
Certificate works but the site loads the wrong content. This can happen if the DocumentRoot is incorrect or if the virtual host order is wrong. Use apachectl -S to list all virtual hosts and verify the configuration.

Frequently Asked Questions

Can I use the same IP address for multiple SSL domains?

Yes, with SNI (Server Name Indication) which is supported by all modern browsers and Apache 2.4. The server uses the domain name sent by the client to select the correct certificate.

Do I need a separate IP for each domain?

No, SNI eliminates the need for multiple IPs. However, if you have very old clients that don’t support SNI, they may not work, but that’s rare today.

What is the difference between SSLCertificateChainFile and SSLCertificateFile?

The certificate file is your domain’s public certificate. The chain file contains intermediate certificates from the CA that link your certificate to a trusted root. Some CAs provide a combined file that includes both.

How do I renew my SSL certificates?

If using certbot, run sudo certbot renew to renew all certificates. For manually managed certificates, you need to obtain new ones from your CA and replace the files, then reload Apache.

Can I have both HTTP and HTTPS for the same domain?

Yes, you can have separate virtual hosts for port 80 and 443. Many people redirect HTTP to HTTPS, but you can also serve different content if needed.

What is a wildcard certificate and how does it work?

A wildcard certificate covers one domain and all its subdomains, e.g., *.example.com works for www.example.com and mail.example.com. It does not cover other domains like example.org.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →