Free tools Windows power users keep installed
One-click scans. No signup required.
Rekeying an SSL certificate on Apache means creating a new private key and certificate-signing request (CSR), having a certificate authority issue a certificate for that CSR, installing the certificate and its intermediate chain, and then reloading Apache. It is different from simply renewing a certificate: the replacement uses a different private key.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Keep the existing key, certificate, and Apache configuration available until the new certificate is being served successfully. The safest sequence is to inventory the active HTTPS VirtualHost, generate and protect a new key, request a certificate containing every required hostname, verify that certificate against the new key, run an Apache configuration test, reload the service, and inspect the live endpoint from an independent client.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What rekeying changes
A certificate and its private key form a pair. During a rekey, you deliberately generate a new private key instead of reusing the old one. The CSR is built from that new key and identifies the names the certificate must cover. The certificate authority signs the CSR and returns a new server certificate, usually together with one or more intermediate certificates.
The old certificate normally remains valid until its own expiration or revocation, but it must no longer be paired with the new key. Do not overwrite the only copy of the old files before testing. Retaining them gives you a rollback path if the new chain is incomplete, the wrong VirtualHost is edited, or Apache cannot read the replacement key.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Rekeying, renewal, and replacement
- Rekey: generate a new private key and CSR, then obtain a certificate for that CSR.
- Renewal: obtain a later-validity certificate, sometimes using the same key, depending on the CA or automation policy.
- Replacement: install a different certificate, which may or may not involve a new key.
This guide covers the rekey path and notes where a Certbot/ACME deployment differs from a manually issued certificate.
Before generating anything: inventory the live Apache site
First determine which configuration Apache actually uses. Editing a disabled file or the wrong name-based VirtualHost can leave the old certificate in production even though the new files look correct.
Locate the HTTPS VirtualHost and directives
List enabled sites and inspect the HTTPS blocks under /etc/apache2/sites-enabled/. Find the VirtualHost whose ServerName or ServerAlias matches the hostname clients use. Record these directives exactly:
SSLCertificateFile— the server certificate path.SSLCertificateKeyFile— the private-key path.SSLCertificateChainFile, if the configuration uses a separate intermediate-chain file.
A quick search can reveal the active references:
sudo grep -RInE 'SSLCertificate(File|KeyFile|ChainFile)|Server(Name|Alias)' /etc/apache2/sites-enabled/Also note whether SSL is enabled with the ssl module and whether a site-specific include supplies additional TLS settings.
Back up the current state
Copy the current certificate, key, chain, and relevant VirtualHost configuration to a root-readable backup location. Preserve file ownership and permissions where possible, and keep an encrypted copy of the old private key offline. Do not place private keys in a public web directory or a broadly readable project directory.
Confirm every name that must be covered
Write down the exact DNS names that clients will request, including the apex name, a www alias, API hostnames, or other names routed to this VirtualHost. Modern certificate validation relies on Subject Alternative Names (SANs). Every required DNS name must be included by the CA’s request workflow; a Common Name alone is not a substitute for missing SAN entries.
Recommended Free Tools
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Generate the new private key and CSR
Generate the replacement key in a protected working directory, separate from the old key. The traditional RSA example documented by Apache is:
openssl genrsa -des3 -out server.key 2048
openssl req -new -key server.key -out server.csrThe first command creates a 2048-bit RSA key encrypted with a passphrase. The second creates a CSR and prompts for subject information. When OpenSSL asks for the Common Name, enter the site’s fully qualified domain name (FQDN), as Apache’s documentation advises. Follow the selected CA’s current request tooling to place all required DNS names in the CSR’s SAN extension.
Protect the key while the CSR is submitted
Treat server.key as a credential. Restrict it to the account that must read it, normally root and the account under which Apache starts, and use restrictive permissions such as owner-only read access where your startup design permits. Never email the key or submit it to a CA; only the CSR is sent for signing.
An encrypted key requires Apache to obtain its passphrase when the service starts. Apache warns that removing the passphrase removes a layer of security. Ubuntu likewise describes an unattended service without a passphrase as convenient but insecure: anyone who compromises the key can compromise the server. Decide deliberately whether your availability requirements justify an unencrypted runtime key. If they do, keep an encrypted backup offline, limit ownership and permissions, and protect the host and backups accordingly.
Obtain the certificate for the new CSR
Submit server.csr through the CA process you use. The issuance method affects how hostnames are validated, how renewals run, and who controls the private key.
| Aspect | Manual CA issuance | Certbot with ACME |
|---|---|---|
| Request method | Submit the CSR to the CA and complete its validation process. | Certbot requests and installs a certificate through an ACME challenge. |
| Hostname coverage | Specify every required SAN in the CA’s CSR and order workflow. | Pass every required name with repeated -d options. |
| Renewal | You schedule issuance, installation, and reload operations yourself. | Certbot can automate renewal; test it with a dry run. |
| File layout | You choose paths such as /etc/ssl/certs and /etc/ssl/private. |
Certbot maintains files under /etc/letsencrypt/live/<domain>/. |
| Reload behavior | You run Apache’s configuration test and reload after installation. | The Apache plugin locates the matching VirtualHost, writes TLS directives, and reloads Apache. |
| Additional access | Depends on the CA’s validation method. | HTTP-01 may require the web server; DNS-01 or centralized workflows require access to the relevant DNS system or automation API. |
| Private-key control | You generate and retain the key locally before submitting the CSR. | Certbot generates and stores the private key locally as privkey.pem. |
Certbot and Apache
For an Apache-managed ACME request, Ubuntu documents a command such as:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo certbot --apache -d example.com -d www.example.comReplace the example names with every hostname that must be covered. Certbot’s Apache plugin finds the VirtualHost matching the specified domains, adds the necessary TLS directives, and reloads Apache. Review the resulting configuration rather than assuming that a similarly named site was selected. In nonstandard layouts, or when DNS-01 is required, follow the CA’s documented workflow instead of forcing the Apache plugin to modify an unrelated VirtualHost.
Install the certificate, chain, and key
Manual certificate files
Ubuntu commonly uses /etc/ssl/certs for public certificates and /etc/ssl/private for private keys. Copy the newly issued files into protected locations, set ownership and permissions, and point the exact HTTPS VirtualHost at them:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSSLCertificateFile /etc/ssl/certs/example.com.crt
SSLCertificateKeyFile /etc/ssl/private/example.com.key
# If your Apache configuration uses a separate chain file:
SSLCertificateChainFile /etc/ssl/certs/issuer-chain.pemUse the chain file supplied by the CA, not an arbitrary certificate downloaded from an unrelated site. Preserve the CA’s required order: the server certificate first, followed by the intermediate certificate or certificates. Some current Apache configurations can use a certificate file that already contains the server certificate and intermediates; follow the layout supported by the Apache version and configuration you are running. Do not configure a path that contains the old certificate while testing the new key.
Certbot-managed files
Certbot stores the active material under /etc/letsencrypt/live/<domain>/. In that layout, fullchain.pem contains the server certificate followed by intermediate certificates, while privkey.pem contains the private key. Use the paths Certbot supplies rather than copying files into a second location that future renewals will not update.
After a rekey, confirm that the live symlinks and Apache directives refer to the intended domain directory. If several certificates exist, editing one domain’s files will not change a different VirtualHost that serves the same machine.
Verify that the certificate matches the new key
Perform the match check before replacing the active directives or reloading Apache. For an RSA key, Apache documents comparing the modulus digest from the certificate and key:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
openssl x509 -noout -modulus -in new.crt | openssl md5
openssl rsa -noout -modulus -in new.key | openssl md5The two resulting digests must be identical. A mismatch means the certificate was issued from another CSR or the wrong key file was selected; do not activate that pair. The modulus procedure is for RSA material. For a different key type, use the corresponding OpenSSL public-key comparison supported by that key type rather than treating a failed RSA command as proof of a mismatch.
Inspect identity, dates, and SANs
openssl x509 -in new.crt -noout -subject -issuer -dates -ext subjectAltNameCheck the subject, issuer, validity start and end dates, and every SAN against the hostnames recorded during inventory. Confirm that the issuer and validity period are what the CA order specifies. A certificate can match the private key and still be unusable because it omits an alias or is already outside its validity period.
Validate the intermediate chain
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt -untrusted issuer-chain.pem new.crtThis verifies the leaf certificate using Ubuntu’s commonly available trust bundle and the supplied intermediate chain. The exact trust-store path can vary by Ubuntu release. If verification fails, check that the chain file is the correct one, is PEM formatted, and contains intermediates in the expected order. A successful local verification does not replace testing what Apache actually serves.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Update Apache safely
Enable the required module and site
If SSL is not enabled on the installation, Ubuntu documents:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →sudo a2enmod sslEnable the HTTPS site when necessary, then ensure the edited VirtualHost is the one enabled under /etc/apache2/sites-enabled/. Avoid enabling two competing default HTTPS sites unless you understand which one will win name-based selection.
Run a configuration test first
sudo apache2ctl configtestProceed only when the result is Syntax OK. This catches malformed directives, missing files, and unreadable keys before the running service is disturbed. If the command reports a line number, inspect that file and line rather than repeatedly restarting Apache.
Reload or restart
For a normal key and a configuration that passes the test, prefer a graceful reload:
sudo systemctl reload apache2A reload lets existing connections finish while new connections use the new configuration. If reload is unavailable, or if Apache must prompt for an encrypted key passphrase during startup, use the documented restart path and provide the passphrase through the server’s secure operational process. Do not put a private-key passphrase in shell history, a world-readable script, or an unprotected automation variable.
Verify what clients receive
Testing the files on disk is not enough; the endpoint may select a different VirtualHost or certificate. Query the public hostname with Server Name Indication (SNI) and inspect the certificate returned by Apache:
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltNameCompare the displayed subject, SANs, issuer, and dates with the certificate you installed. From an independent network or machine, also load the site in a browser and inspect its certificate chain. This catches DNS pointing to another server, a load balancer terminating TLS before Apache, an incorrect SNI match, or a stale certificate on a second node.
Test automated renewal without changing production files
For a Certbot-managed deployment, run:
sudo certbot renew --dry-runThe dry run exercises the renewal workflow without applying a real renewal. Review its output and any renewal hooks so that a future certificate will be installed and Apache reloaded automatically.
Troubleshooting failed reloads and wrong certificates
| Symptom | Likely cause | What to check |
|---|---|---|
apache2ctl configtest reports a key error |
The key path is wrong, unreadable, malformed, or encrypted without a startup method. | Check the exact SSLCertificateKeyFile path, PEM formatting, ownership, mode, and passphrase handling. |
| Certificate/key verification digests differ | The certificate came from a different CSR or the wrong key was copied. | Return to the new CSR and key pair; obtain a certificate for that CSR instead of forcing the files together. |
| Browser reports an incomplete chain | An intermediate certificate is missing or ordered incorrectly. | Install the CA-supplied chain, use the correct fullchain.pem for Certbot, and repeat chain verification. |
| The old certificate is still served | The wrong VirtualHost, node, or TLS terminator was edited. | Check SNI with openssl s_client, inspect enabled sites, verify DNS and load-balancer routing, and update every serving node. |
| A hostname is rejected | The name is absent from the certificate SAN list. | Issue a new certificate containing every required DNS name and pass each name to the ACME command when applicable. |
| Reload succeeds but connections fail | The certificate file is malformed, the chain is incompatible, or another TLS directive conflicts. | Run apache2ctl configtest, inspect Apache’s error log, validate the PEM files, and compare the active VirtualHost with the intended one. |
Apache’s error log is the authoritative place to look when the service refuses to reload. Common errors include a certificate/private-key mismatch, an unreadable private key, a malformed PEM block, a missing intermediate, and a directive placed in a VirtualHost that does not serve the requested name.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSecurity and rollback practices after activation
Leave the old certificate and key untouched until the replacement has been confirmed from the production endpoint and any rollback window has passed. Once the new certificate is demonstrably serving on every TLS-terminating node, retire the old material according to your organization’s key-destruction policy. Keep only the backups required for documented recovery, and keep private-key backups encrypted.
Review permissions after package updates, configuration management runs, or certificate automation changes. Certificate files may be broadly readable, but private keys should remain restricted to the minimum accounts that need them. Certbot’s privkey.pem is especially sensitive because it is the live signing key for the domain.
Finally, document the certificate’s covered names, issuing method, file locations, renewal mechanism, reload hook, and the person or system responsible for DNS or HTTP validation. That record prevents the next rekey from becoming an emergency search through multiple VirtualHosts and servers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
