Set Up Let’s Encrypt for Multiple Apache Virtual Hosts

This guide walks you through securing multiple Apache virtual hosts with free Let’s Encrypt SSL/TLS certificates using Certbot. You’ll learn how to obtain and configure certificates for several domains or subdomains on a single server, and how to automate renewal. By the end, all your sites will be served over HTTPS with minimal ongoing maintenance.

What You’ll Need

A Linux server (Ubuntu/Debian, CentOS/RHEL, or similar) with Apache installed and running.
Root or sudo access to the server.
Each domain or subdomain you want to secure must have a DNS A/AAAA record pointing to your server’s public IP address.
Port 80 (HTTP) and port 443 (HTTPS) must be open in your firewall and reachable from the internet.
Apache must have the mod_ssl module enabled (usually done automatically when you install Certbot’s Apache plugin).

Step-by-Step

Update your system and install Certbot. On Ubuntu/Debian: sudo apt update && sudo apt install certbot python3-certbot-apache. On CentOS/RHEL: sudo yum install certbot python3-certbot-apache (or use dnf). This installs Certbot and the Apache plugin that automates configuration.
Verify your Apache virtual hosts. Run sudo apachectl -S (or httpd -S on some systems) to list all configured virtual hosts. Make sure each domain you plan to secure appears as a ServerName or ServerAlias in a virtual host block. If a domain is missing, add it to the appropriate configuration file before proceeding.
Obtain certificates for all domains at once. Run sudo certbot --apache. Certbot will scan your Apache configuration and list all virtual hosts it finds. You’ll be prompted to choose which domains to activate HTTPS for. Enter the numbers corresponding to all the domains you want to secure, separated by commas (e.g., 1,2,3). If you have many domains, you can also use sudo certbot --apache -d example.com -d www.example.com -d blog.example.com to specify them directly.
Choose the redirect option. When asked whether to redirect HTTP to HTTPS, select 2: Redirect to automatically configure Apache to send all HTTP traffic to HTTPS. This is recommended for security and SEO. You can change this later by editing the virtual host configuration.
Wait for the certificate issuance. Certbot will communicate with Let’s Encrypt’s servers, verify domain ownership (via HTTP-01 challenge by default), and install the certificates. It will also modify your Apache virtual host configurations to use the new certificates and enable SSL. You should see a success message like “Congratulations! You have successfully enabled HTTPS” for each domain.
Test your HTTPS sites. Visit https://yourdomain.com in a browser. You should see a padlock icon and no security warnings. Also test that HTTP redirects to HTTPS (e.g., visit http://yourdomain.com and it should redirect to the HTTPS version).
Set up automatic renewal. Certbot installs a systemd timer (on most distributions) that runs twice a day and automatically renews certificates that are within 30 days of expiry. Verify it’s active with sudo systemctl status certbot.timer. You can also test renewal with sudo certbot renew --dry-run to ensure everything works.
Verify the renewal timer is enabled. If the timer is not active, enable it with sudo systemctl enable --now certbot.timer. On older systems, you may need to add a cron job: 0 3 * * * /usr/bin/certbot renew --quiet.

Common Mistakes

Not pointing DNS to the server before running Certbot. Certbot must be able to reach your domain over port 80 to verify ownership. If DNS isn’t propagated, you’ll get a “Domain not found” error.
Choosing only one domain when you have many. When Certbot asks which domains to activate, it’s easy to accidentally select only the first one. Double-check that you’ve entered all the numbers.
Forgetting to open port 443 in the firewall. Even if certificates are issued, HTTPS won’t work if port 443 is blocked. Use sudo ufw allow 443/tcp (Ubuntu) or sudo firewall-cmd --permanent --add-service=https (CentOS) to open it.
Using the wrong virtual host configuration. If you have multiple virtual hosts with the same ServerName but different ports, Certbot might get confused. Ensure each domain has a unique ServerName in its virtual host block.
Not checking the renewal timer after installation. Some manual installs or older systems don’t enable the timer by default. Always verify it’s running.

Tips

Use wildcard certificates if you have many subdomains (e.g., *.example.com). This requires DNS-01 challenge, which is more complex but covers unlimited subdomains. Certbot supports it with the --manual flag or DNS plugins.
Keep your Apache configuration files organized. Certbot adds SSL directives directly to your virtual host blocks. If you have a central config file, consider using separate .conf files per site to make maintenance easier.
Test renewal with sudo certbot renew --dry-run after any major Apache configuration change to ensure the renewal process still works.
Monitor your certificate expiry with a service like UptimeRobot or a cron job that checks the expiry date using openssl s_client.
If you’re behind a reverse proxy or load balancer, you may need to configure Certbot to use the webroot method instead of the Apache plugin. Use sudo certbot certonly --webroot -w /var/www/html -d example.com and then manually configure the SSL virtual hosts.

Troubleshooting

Certbot fails with “Failed to connect to :80″. Check that your domain resolves to your server’s IP with dig or nslookup. Ensure Apache is running and port 80 is open. Also check that no other service (like a firewall) is blocking port 80 from the internet.
Certbot says “No names were found in your configuration files.” This means Certbot couldn’t find any virtual hosts with a ServerName that matches the domains you’re trying to secure. Double-check your virtual host definitions with apachectl -S and ensure the ServerName is correct.
HTTPS works but HTTP doesn’t redirect. If you didn’t choose the redirect option during setup, or if you later modified the config, you need to add a redirect rule manually. In the virtual host for port 80, add: Redirect permanent / https://yourdomain.com/. Then reload Apache: sudo systemctl reload apache2 (or httpd).
After adding a new domain, the old certificate still covers it. Certbot doesn’t automatically add new domains to existing certificates. Run sudo certbot --apache -d newdomain.com to get a new certificate for that domain. Alternatively, you can expand an existing certificate with sudo certbot certonly --expand -d existing.com -d newdomain.com.
Renewal fails with a validation error. This usually means the HTTP-01 challenge can’t be completed. Check that the domain still points to your server, port 80 is open, and Apache is running. Also ensure that no firewall is blocking Certbot’s requests.
Apache won’t start after Certbot modifies config. Run sudo apachectl configtest to check for syntax errors. If there are errors, review the modified virtual host files (usually in /etc/apache2/sites-available/ or /etc/httpd/conf.d/) and fix any issues. The most common problem is a missing or incorrect certificate path.

Frequently Asked Questions

How many domains can I secure with one Let’s Encrypt certificate?

Let’s Encrypt allows up to 100 names per certificate. You can include multiple domains and subdomains as long as they all resolve to your server. Certbot will handle the SAN (Subject Alternative Name) list automatically.

Do I need to renew certificates manually?

No. Certbot sets up a systemd timer that automatically checks for renewal twice a day and renews certificates that are within 30 days of expiry. You only need to intervene if renewal fails.

Can I use Let’s Encrypt on a server with multiple IPs?

Yes. The HTTP-01 challenge only requires that each domain resolves to the server’s IP address. As long as the DNS points to the correct IP, the challenge will succeed.

What if I have a domain that doesn’t point to my server (e.g., a parked domain)?

You cannot get a certificate for a domain that doesn’t resolve to your server, because Let’s Encrypt needs to verify ownership by accessing the domain over HTTP. You’ll need to either point the domain to your server temporarily or use a DNS-01 challenge with a DNS plugin.

Will HTTPS break my existing Apache virtual host configurations?

Certbot modifies your virtual host files to add SSL directives and a redirect from HTTP to HTTPS. It preserves your existing settings, but it’s always a good idea to backup your configuration files before running Certbot.

Can I remove the HTTP to HTTPS redirect later?

Yes. You can edit the virtual host for port 80 and remove the Redirect line. However, it’s strongly recommended to keep the redirect to ensure all traffic is encrypted.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →