# Source: https://infisical.com/docs/documentation/platform/pki/integration-guides/apache-certbot.md

> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Apache Server

> Learn how to issue TLS certificates from Infisical using ACME enrollment on Apache Server with Certbot

This guide demonstrates how to use Infisical to issue TLS certificates for your [Apache HTTP Server](https://httpd.apache.org/).

It uses [Certbot](https://certbot.eff.org/), an installable [ACME](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment) client, to request and renew certificates from Infisical using the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme) configured on a [certificate profile](/documentation/platform/pki/certificates/profiles). Apache benefits from excellent Certbot integration, allowing both certificate-only mode and automatic SSL configuration.

## Prerequisites

Before you begin, make sure you have:

* An [Apache HTTP Server](https://httpd.apache.org/) running on a Linux system with administrative access.
* A [certificate profile](/documentation/platform/pki/certificates/profiles) configured with the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme) in Infisical.
* Network connectivity from your Apache server to Infisical.
* Port 80 open and reachable for ACME [HTTP-01](https://letsencrypt.org/docs/challenge-types/#http-01-challenge) validation.

## Guide

<Steps>
  <Step title="Obtain ACME Configuration from Infisical">
    Navigate to your certificate management project in Infisical and locate your [certificate profile](/documentation/platform/pki/certificates/profiles) configured with the [ACME enrollment method](/documentation/platform/pki/enrollment-methods/acme).
    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/acme/certificate-profile-acme-option.png" alt="Certificate profile with ACME enrollment option" />

    Click the **Reveal ACME EAB** option to view the ACME configuration details.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pki/acme/acme-configuration-modal.png" alt="ACME configuration modal showing directory URL and EAB credentials" />

    From the ACME configuration, gather the following values:

    * ACME Directory URL: The URL that Certbot will use to communicate with Infisical's ACME server. This takes the form `https://your-infisical-instance.com/api/v1/cert-manager/certificate-profiles/{profile-id}/acme/directory`.
    * EAB Key Identifier (KID): A unique identifier that tells Infisical which ACME account is making the request.
    * EAB Secret: A secret key that authenticates your ACME client with Infisical.

    <Note>
      Keep your EAB credentials secure as they authenticate your ACME client with Infisical PKI. These credentials are unique to each [certificate profile](/documentation/platform/pki/certificates/profiles) and should not be shared.
    </Note>
  </Step>

  <Step title="Install Certbot">
    Install Certbot with the Apache plugin on the server where Apache is running by following the official Certbot [installation guide](https://certbot.eff.org/instructions).

    The installation guide provides up-to-date instructions for various Linux distributions and package managers, ensuring you get the most current version and proper Apache plugin integration.

    After installation, you can verify that Certbot has been installed correctly by running:

    ```bash  theme={"dark"}
    certbot --version
    ```
  </Step>

  <Step title="Request Certificate Using Certbot">
    Run the following command to request a certificate from Infisical:

    ```bash  theme={"dark"}
    sudo certbot certonly \
      --apache \
      --server "https://your-infisical-instance.com/api/v1/cert-manager/certificate-profiles/{profile-id}/acme/directory" \
      --eab-kid "your-eab-key-identifier" \
      --eab-hmac-key "your-eab-secret" \
      -d example.infisical.com \
      --email admin@example.com \
      --agree-tos \
      --non-interactive
    ```

    For guidance on each parameter:

    * `certonly`: Instructs Certbot to request a certificate without modifying your Apache configuration files; this mode is recommended if you prefer to manage your Apache SSL configuration manually or have a complex setup.
    * `--apache`: Specifies the Apache plugin so Certbot can solve the [HTTP-01](https://letsencrypt.org/docs/challenge-types/#http-01-challenge) challenge by creating temporary files served by Apache.
    * `--server`: The Infisical ACME directory URL from Step 1. This instructs Certbot to communicate with Infisical's ACME server instead of Let's Encrypt.
    * `--eab-kid`: Your External Account Binding (EAB) Key Identifier from Step 1.
    * `--eab-hmac-key`: The EAB secret associated with the KID from Step 1.
    * `-d`: Specifies the domain name for which the certificate is being requested.
    * `--email`: The contact email for expiration notices and account recovery.
    * `--agree-tos`: Accepts the ACME server's Terms of Service.
    * `--non-interactive`: Runs Certbot without prompting for user input (recommended for automation).

    The Certbot command generates a private key on your server, creates a Certificate Signing Request (CSR) using that key, and sends the CSR to Infisical for certificate issuance. Certbot stores the private key and resulting leaf certificate and full certificate chain in `/etc/letsencrypt/live/{domain-name}/`.

    If `--certonly` is used: Certbot does **not** modify your Apache configuration, so you must manually update your Apache virtual host to reference the new certificate files and reload the server to apply the changes.

    Here's an example SSL virtual host configuration for Apache:

    ```apache  theme={"dark"}
    <VirtualHost *:443>
        ServerName example.infisical.com
        DocumentRoot /var/www/html

        SSLEngine on
        SSLCertificateFile /etc/letsencrypt/live/example.infisical.com/cert.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/example.infisical.com/privkey.pem
        SSLCertificateChainFile /etc/letsencrypt/live/example.infisical.com/chain.pem

        # Your existing configuration...
    </VirtualHost>
    ```

    After updating the virtual host configuration, test and reload Apache to apply the changes:

    ```bash  theme={"dark"}
    sudo apache2ctl configtest
    sudo systemctl reload apache2
    ```

    If `--certonly` was **not** used: Certbot uses installer mode, which attempts to automatically configure HTTPS by updating your Apache virtual host configuration and reloading the server if needed.

    At this point, your Apache server should be successfully serving HTTPS using the certificate issued by Infisical.
  </Step>

  <Step title="Verify Certificate Installation">
    After configuring Apache SSL, verify that your certificate was issued correctly and Apache is serving it properly.

    Check that the certificate files were created by Certbot:

    ```bash  theme={"dark"}
    sudo ls -la /etc/letsencrypt/live/example.infisical.com/
    ```

    You should see files like:

    * `cert.pem` (your certificate)
    * `chain.pem` (certificate chain)
    * `fullchain.pem` (certificate + chain)
    * `privkey.pem` (private key)
  </Step>

  <Step title="Renew Your Certificate with Certbot">
    Certbot automatically installs a `systemd` timer during installation. This timer runs twice per day and checks whether any certificates are due for renewal. Because Certbot stores the ACME server URL and EAB credentials from your initial request, renewal will automatically use the same Infisical ACME configuration—no additional settings are required.

    Note that Certbot automatically renews certificates when they are within 30 days of expiration; renewal settings can be adjusted in `/etc/letsencrypt/renewal/{domain-name}.conf`.

    ```ini  theme={"dark"}
    # ... your existing configuration ...

    renew_before_expiry = 30 days
    ```

    To test the renewal process, run the following command:

    ```bash  theme={"dark"}
    sudo certbot renew --dry-run
    ```

    This command simulates the full renewal process without modifying your active certificate. If the dry run succeeds, automatic renewal will work as expected.

    To trigger an actual renewal immediately, run the following command:

    ```bash  theme={"dark"}
    sudo certbot renew --force-renewal
    ```

    Note that after a certificate is renewed, Apache must be reloaded so it can begin using the new certificate. To do this, run the following command:

    ```bash  theme={"dark"}
    sudo systemctl reload apache2
    ```

    To automate the process of renewing a certificate and reloading Apache, you can create a simple deploy hook that Certbot will run after every successful renewal.

    Inside `/etc/letsencrypt/renewal-hooks/deploy/reload-apache.sh`, add the following:

    ```bash  theme={"dark"}
    #!/bin/sh
    systemctl reload apache2
    ```

    Then make the hook executable:

    ```bash  theme={"dark"}
    sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-apache.sh
    ```

    Alternatively, you can use the `--post-hook` option when manually renewing:

    ```bash  theme={"dark"}
    sudo certbot renew --post-hook "systemctl reload apache2"
    ```

    <Note>
      Certbot automatically renews certificates when they are within 30 days of expiration using its built-in systemd timer. The deploy hook above will run after each successful renewal, handling the Apache reload automatically. Apache has native Certbot plugin integration, so no additional configuration is typically needed.
    </Note>
  </Step>
</Steps>