Apache · Configuration and operations
How do you configure TLS correctly in Apache?
Short answer
Enable mod_ssl, listen on 443, point SSLCertificateFile and SSLCertificateKeyFile at the certificate and key, restrict protocols to TLS 1.2 and 1.3, and add HSTS only after HTTPS is verified.
TLS configuration has three parts: the certificate chain, the protocol and cipher policy, and the operational lifecycle. A certificate file should contain the leaf certificate plus intermediates, and the private key must be readable only by the service account. Renewal must trigger a reload, or the server keeps serving the expired certificate.
Listen 443 https
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
SSLHonorCipherOrder off
SSLUseStapling on
SSLStaplingCache "shmcb:/var/run/ocsp(128000)"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"Operational checks
- Redirect port 80 to HTTPS after confirming every host has a valid certificate
- Test with openssl s_client and an external TLS scanner, not just a browser
- Keep the chain complete; a missing intermediate works in some browsers and fails elsewhere
- Reload Apache after renewal and monitor certificate expiry independently
- HSTS is hard to undo, so add it only when all subdomains are ready for HTTPS
Session resumption and OCSP stapling reduce handshake cost. For high-traffic sites, confirm that the stapling cache is sized and that the resolver can reach the OCSP responder. If it cannot, stapling silently stops working rather than failing the handshake.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What must the certificate file contain?
- 2How do you verify that TLS is configured correctly?
- 3What are the risks of enabling HSTS too early?
- 4How does OCSP stapling affect latency?
Say it in the interview
I enable mod_ssl and configure the full chain and private key, restrict protocols to TLS 1.2 and 1.3, and set a modern cipher suite. I redirect HTTP only after verification, test with openssl and an external scanner, and add HSTS last because it is hard to roll back. Renewal must reload Apache, so I monitor expiry and test the reload path.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.