Serve the site over HTTPS on Apache

Why it matters

Without HTTPS everything visitors send and receive, including passwords and form data, can be read or changed by anyone on the network path. Browsers also label plain http pages as not secure.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Enable mod_ssl (on Debian and Ubuntu: sudo a2enmod ssl) and get a certificate (sudo certbot --apache -d example.com does it and writes the virtual host), or add a *:443 virtual host like the one below by hand.
2. Copy the DocumentRoot and other directives of the *:80 virtual host into it, run sudo apachectl configtest, then reload Apache.
3. Stage 1: test the important pages over https and fix mixed content. Stage 2: when everything works, redirect the *:80 virtual host to https.

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

    # ... the same DocumentRoot and directives as the *:80 virtual host
</VirtualHost>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Stop redirecting HTTPS to HTTP
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Redirect HTTP straight to HTTPS
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS