Free Let's Encrypt SSL for Apache on AlmaLinux 9

HTTPS is expected by browsers and search engines, and Let's Encrypt provides certificates at no cost. On a VPS Linux Infrawire running AlmaLinux 9, Certbot can obtain the certificate, edit the Apache configuration and renew it by itself. The same steps work on Rocky Linux 9.

📋 Prerequisites

An AlmaLinux 9 VPS with root or sudo access (IP and password in your customer area).
A domain name, example.com, whose A record (and AAAA for IPv6) points to VPS_IP. Wait for DNS propagation first.
Apache (httpd) serving the site over HTTP on port 80.

1. Install Apache and open the firewall

If Apache is not installed yet, install and start it. Then open HTTP and HTTPS in firewalld; port 80 is required for the Let's Encrypt validation.

Bash
1dnf install -y httpd
2systemctl enable --now httpd
3firewall-cmd --permanent --add-service=http
4firewall-cmd --permanent --add-service=https
5firewall-cmd --reload
6firewall-cmd --list-services

2. Create a virtual host for your domain

Certbot looks for a ServerName matching your domain, so create a dedicated virtual host.

Bash
1mkdir -p /var/www/example.com/public_html
2echo "Hello" > /var/www/example.com/public_html/index.html

Create /etc/httpd/conf.d/example.com.conf:

Apache
1<VirtualHost *:80>
2    ServerName example.com
3    ServerAlias www.example.com
4    DocumentRoot /var/www/example.com/public_html
5</VirtualHost>

Check the syntax and reload:

Bash
1apachectl configtest
2systemctl reload httpd

3. Install Certbot and mod_ssl

Certbot comes from the EPEL repository. mod_ssl provides the Apache TLS module and a default certificate that httpd needs in order to listen on 443.

Bash
1dnf install -y epel-release
2dnf install -y certbot python3-certbot-apache mod_ssl

4. Request the certificate

Run Certbot with the Apache plugin. It validates the domain over HTTP, writes a new *-le-ssl.conf virtual host and can add the HTTP to HTTPS redirect.

Bash
1certbot --apache -d example.com -d www.example.com

Enter a real email address (used for expiry warnings), accept the terms, and choose the redirect option when asked. Every name passed with -d must resolve to this server, otherwise the validation fails.

If SELinux is enforcing (the default), nothing special is required for a standard setup. Do not disable it to work around an error.

5. Check automatic renewal

Let's Encrypt certificates last 90 days. On AlmaLinux 9 the package installs a systemd timer, which runs twice a day and renews only certificates close to expiry.

Bash
1systemctl list-timers | grep certbot
2systemctl status certbot-renew.timer

If the timer is not listed, enable it:

Bash
1systemctl enable --now certbot-renew.timer

Simulate a renewal without touching the real certificate:

Bash
1certbot renew --dry-run

The last line should say that all simulated renewals succeeded. Apache is reloaded automatically after a real renewal.

Verification

Bash
1certbot certificates
2curl -I https://example.com
3curl -I http://example.com

The first command lists the domains and the expiry date. The HTTPS request must return 200, and the HTTP request should answer with a 301 to the HTTPS address. In a browser, the padlock must show a valid certificate issued by Let's Encrypt. For the full certificate chain you can run openssl s_client -connect example.com:443 -servername example.com.

Troubleshooting

Challenge failed or timeout during validation: DNS does not point to the server yet, or port 80 is blocked. Check dig +short example.com, firewall-cmd --list-services and any firewall in front of the VPS.
Certbot cannot find a matching virtual host: the ServerName or ServerAlias in /etc/httpd/conf.d/ does not match the domain you passed. Fix it, run apachectl configtest, then retry. You can also use certbot certonly --apache and configure the paths yourself.
Too many certificates or failed validations (rate limit): Let's Encrypt limits repeated attempts. Test with certbot --apache --dry-run first and wait before retrying.
Site unreachable on 443 after install: HTTPS is not open in firewalld, or httpd was not reloaded. Run firewall-cmd --permanent --add-service=https, firewall-cmd --reload and systemctl restart httpd.

🔐 Your Apache site on AlmaLinux 9 now serves HTTPS and renews its certificate on its own.