SSL Setup for rConfig V8 Core

After reading this page, I can secure my rConfig V8 Core install with HTTPS using either a Let’s Encrypt certificate or a self-signed certificate, configure automatic renewal, and verify the connection. The same steps cover Rocky Linux, CentOS, RHEL, and Ubuntu.

When to use this

Use this page when you are bringing a new rConfig V8 Core server online, or when you need to add HTTPS to an existing HTTP-only install. Choose Let’s Encrypt for production servers with a public domain, or a self-signed certificate for internal, air-gapped, or development environments.

Some features need valid SSL

Features such as clipboard operations and API integrations require a valid SSL configuration. Running rConfig over plain HTTP can stop these features working correctly.

SSL support boundary

We strongly recommend HTTPS, but the range of possible environments means we cannot provide direct support for SSL configuration. For environment-specific issues, consult your SSL solution’s documentation.

Prerequisites

• Domain configured and resolving to your server
• Apache web server installed and running
• Ports 80 (HTTP) and 443 (HTTPS) open on the firewall
• Sudo or root privileges on the server
• For Let’s Encrypt: the domain must be publicly accessible so certbot can complete validation

Which certificate type should I use?

Let’s Encrypt certificates

Best for production environments with public-facing domains.

• Free, automated certificate management
• Trusted by all major browsers
• 90-day validity with automated renewal
• Requires a publicly accessible domain, valid DNS records, and port 80 open for validation

Self-signed certificates

Best for internal networks, development, and testing environments.

• No external dependencies, works in air-gapped environments
• Full control over certificate properties
• Browsers show a security warning because the certificate is not issued by a trusted Certificate Authority
• Not suitable for public-facing production environments

Set up SSL

Pick the tab that matches your certificate type and operating system.

Let's Encrypt - Rocky/RHEL

Let’s Encrypt on Rocky Linux, CentOS, RHEL

1. Update system packages.

   yum -y update

2. Install mod_ssl.

   yum -y install mod_ssl

3. Install certbot and its dependencies.

   # Enable EPEL repository
   yum -y install epel-release
   
   # Install required utilities
   yum -y install yum-utils
   
   # Install certbot for Apache
   yum -y install certbot python3-certbot-apache

4. Stop Apache so certbot can bind to port 80.

   systemctl stop httpd

5. Run certbot and follow the interactive prompts.

   certbot --apache

   Select which domains to activate HTTPS for:

   Which names would you like to activate HTTPS for?
   -------------------------------------------------------------------------------
   1: yourdomainname.com
   2: rconfig.yourdomainname.com
   -------------------------------------------------------------------------------
   Select the appropriate numbers separated by commas and/or spaces, or leave input
   blank to select all options shown (Enter 'c' to cancel):

   Press Enter to select all domains, then choose the redirect option:

   Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
   -------------------------------------------------------------------------------
   1: No redirect - Make no further changes to the webserver configuration.
   2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
   new sites, or if you're confident your site works on HTTPS. You can undo this
   change by editing your web server's configuration.
   -------------------------------------------------------------------------------
   Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

6. Verify the Apache configuration that certbot wrote.

   # Check configuration syntax
   httpd -t
   
   # View SSL virtual host configuration
   cat /etc/httpd/conf/httpd-le-ssl.conf

7. Configure automatic renewal with a cron job.

   crontab -e

   Add this line to renew certificates twice daily:

   0 */12 * * * /usr/bin/certbot renew --quiet --post-hook "systemctl reload httpd"

8. Test the renewal process.

   certbot renew --dry-run

   A successful simulation reports:

   Congratulations, all simulated renewals succeeded

9. Start and enable Apache.

   systemctl start httpd
   systemctl enable httpd

10. Verify HTTPS access.

    curl -I https://your-domain.com

Let's Encrypt - Ubuntu

Let’s Encrypt on Ubuntu

1. Update system packages.

   apt update && apt upgrade -y

2. Install certbot.

   apt install -y certbot python3-certbot-apache

3. Stop Apache so certbot can bind to port 80.

   systemctl stop apache2

4. Run certbot and follow the interactive prompts.

   certbot --apache

   Select which domains to activate HTTPS for:

   Which names would you like to activate HTTPS for?
   -------------------------------------------------------------------------------
   1: yourdomainname.com
   2: rconfig.yourdomainname.com
   -------------------------------------------------------------------------------
   Select the appropriate numbers separated by commas and/or spaces, or leave input
   blank to select all options shown (Enter 'c' to cancel):

   Press Enter to select all domains, then choose the redirect option:

   Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
   -------------------------------------------------------------------------------
   1: No redirect - Make no further changes to the webserver configuration.
   2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
   new sites, or if you're confident your site works on HTTPS. You can undo this
   change by editing your web server's configuration.
   -------------------------------------------------------------------------------
   Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

5. Verify the Apache configuration that certbot wrote.

   # Check configuration syntax
   apache2ctl configtest
   
   # View SSL site configuration
   cat /etc/apache2/sites-available/000-default-le-ssl.conf

6. Confirm automatic renewal. Ubuntu usually configures this via a systemd timer.

   # Check timer status
   systemctl status certbot.timer
   
   # Enable the timer if it is not active
   systemctl enable certbot.timer
   systemctl start certbot.timer

   If the systemd timer is unavailable, add a cron job instead:

   crontab -e

   0 */12 * * * /usr/bin/certbot renew --quiet --post-hook "systemctl reload apache2"

7. Test the renewal process.

   certbot renew --dry-run

   A successful simulation reports:

   Congratulations, all simulated renewals succeeded

8. Start and enable Apache.

   systemctl start apache2
   systemctl enable apache2

9. Verify HTTPS access.

   curl -I https://your-domain.com

Self-Signed - Rocky/RHEL

Self-signed certificate on Rocky Linux, CentOS, RHEL

Browser warnings are expected

Self-signed certificates generate browser warnings. Use them only for internal networks or development environments.

1. Install the required packages.

   yum -y install mod_ssl openssl

2. Create the SSL directories.

   mkdir -p /etc/ssl/private
   mkdir -p /etc/ssl/certs

3. Generate the private key.

   openssl genrsa -out /etc/ssl/private/rconfig.key 2048

4. Generate the certificate signing request (CSR) and answer the prompts.

   openssl req -new -key /etc/ssl/private/rconfig.key -out /etc/ssl/certs/rconfig.csr

   Country Name (2 letter code) [XX]: US
   State or Province Name (full name) []: California
   Locality Name (eg, city) []: San Francisco
   Organization Name (eg, company) []: Your Organization
   Organizational Unit Name (eg, section) []: IT Department
   Common Name (eg, your server's hostname) []: rconfig.yourdomainname.com
   Email Address []: admin@yourdomainname.com

5. Generate the self-signed certificate.

   # Valid for 365 days (adjust -days value as needed)
   openssl x509 -req -days 365 -in /etc/ssl/certs/rconfig.csr \
     -signkey /etc/ssl/private/rconfig.key \
     -out /etc/ssl/certs/rconfig.crt

6. Set the correct permissions and ownership.

   chmod 600 /etc/ssl/private/rconfig.key
   chmod 644 /etc/ssl/certs/rconfig.crt
   chown root:root /etc/ssl/private/rconfig.key
   chown root:root /etc/ssl/certs/rconfig.crt

7. Create the SSL virtual host configuration.

   vim /etc/httpd/conf.d/rconfig-ssl.conf

   Add the following:

   # HTTPS Virtual Host
   <VirtualHost *:443>
       ServerName your-domain.com
       ServerAlias www.your-domain.com
       DocumentRoot /var/www/html/rconfig/public
   
       # SSL Configuration
       SSLEngine on
       SSLCertificateFile /etc/ssl/certs/rconfig.crt
       SSLCertificateKeyFile /etc/ssl/private/rconfig.key
   
       # Modern SSL/TLS Configuration
       SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
       SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
       SSLHonorCipherOrder off
       SSLSessionTickets off
   
       # Security Headers
       Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
       Header always set X-Frame-Options DENY
       Header always set X-Content-Type-Options nosniff
       Header always set X-XSS-Protection "1; mode=block"
       Header always set Referrer-Policy "strict-origin-when-cross-origin"
   
       # Laravel Application Configuration
       <Directory /var/www/html/rconfig/public>
           Options -Indexes +FollowSymLinks
           AllowOverride All
           Require all granted
       </Directory>
   
       # Error and Access Logs
       ErrorLog /var/log/httpd/rconfig-ssl-error.log
       CustomLog /var/log/httpd/rconfig-ssl-access.log combined
   </VirtualHost>
   
   # HTTP to HTTPS Redirect
   <VirtualHost *:80>
       ServerName your-domain.com
       ServerAlias www.your-domain.com
       Redirect permanent / https://your-domain.com/
   </VirtualHost>

8. Test the Apache configuration. It should report Syntax OK.

   httpd -t

9. Restart and enable Apache.

   systemctl restart httpd
   systemctl enable httpd

10. Open the firewall for HTTP and HTTPS.

    firewall-cmd --permanent --add-service=http
    firewall-cmd --permanent --add-service=https
    firewall-cmd --reload

11. Verify HTTPS access. The -k flag accepts the untrusted self-signed certificate.

    curl -Ik https://your-domain.com

Self-Signed - Ubuntu

Self-signed certificate on Ubuntu

Browser warnings are expected

Self-signed certificates generate browser warnings. Use them only for internal networks or development environments.

1. Install the required packages.

   apt update
   apt install -y apache2 openssl

2. Enable the required Apache modules.

   a2enmod ssl
   a2enmod headers
   a2enmod rewrite

3. Create the SSL directories.

   mkdir -p /etc/ssl/private
   mkdir -p /etc/ssl/certs

4. Generate the private key.

   openssl genrsa -out /etc/ssl/private/rconfig.key 2048

5. Generate the certificate signing request (CSR) and answer the prompts.

   openssl req -new -key /etc/ssl/private/rconfig.key -out /etc/ssl/certs/rconfig.csr

   Country Name (2 letter code) [XX]: US
   State or Province Name (full name) []: California
   Locality Name (eg, city) []: San Francisco
   Organization Name (eg, company) []: Your Organization
   Organizational Unit Name (eg, section) []: IT Department
   Common Name (eg, your server's hostname) []: rconfig.yourdomainname.com
   Email Address []: admin@yourdomainname.com

6. Generate the self-signed certificate.

   # Valid for 365 days (adjust -days value as needed)
   openssl x509 -req -days 365 -in /etc/ssl/certs/rconfig.csr \
     -signkey /etc/ssl/private/rconfig.key \
     -out /etc/ssl/certs/rconfig.crt

7. Set the correct permissions and ownership.

   chmod 600 /etc/ssl/private/rconfig.key
   chmod 644 /etc/ssl/certs/rconfig.crt
   chown root:root /etc/ssl/private/rconfig.key
   chown root:root /etc/ssl/certs/rconfig.crt

8. Create the SSL site configuration.

   vim /etc/apache2/sites-available/rconfig-ssl.conf

   Add the following:

   # HTTPS Virtual Host
   <VirtualHost *:443>
       ServerName your-domain.com
       ServerAlias www.your-domain.com
       DocumentRoot /var/www/html/rconfig/public
   
       # SSL Configuration
       SSLEngine on
       SSLCertificateFile /etc/ssl/certs/rconfig.crt
       SSLCertificateKeyFile /etc/ssl/private/rconfig.key
   
       # Modern SSL/TLS Configuration
       SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
       SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
       SSLHonorCipherOrder off
       SSLSessionTickets off
   
       # Security Headers
       Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
       Header always set X-Frame-Options DENY
       Header always set X-Content-Type-Options nosniff
       Header always set X-XSS-Protection "1; mode=block"
       Header always set Referrer-Policy "strict-origin-when-cross-origin"
   
       # Laravel Application Configuration
       <Directory /var/www/html/rconfig/public>
           Options -Indexes +FollowSymLinks
           AllowOverride All
           Require all granted
       </Directory>
   
       # Error and Access Logs
       ErrorLog ${APACHE_LOG_DIR}/rconfig-ssl-error.log
       CustomLog ${APACHE_LOG_DIR}/rconfig-ssl-access.log combined
   </VirtualHost>
   
   # HTTP to HTTPS Redirect
   <VirtualHost *:80>
       ServerName your-domain.com
       ServerAlias www.your-domain.com
       Redirect permanent / https://your-domain.com/
   </VirtualHost>

9. Test the Apache configuration. It should report Syntax OK.

   apache2ctl configtest

10. Enable the SSL site and disable the default site.

    a2ensite rconfig-ssl.conf
    a2dissite 000-default.conf

11. Restart and enable Apache.

    systemctl restart apache2
    systemctl enable apache2

12. Open the firewall (if UFW is enabled).

    ufw allow 'Apache Full'
    ufw reload

13. Verify HTTPS access. The -k flag accepts the untrusted self-signed certificate.

    curl -Ik https://your-domain.com

Configure rConfig behind a reverse proxy

When rConfig V8 Core runs behind a reverse proxy (nginx, HAProxy, or a cloud load balancer), the application must be told to recognise HTTPS connections terminated upstream.

1. Edit the environment configuration.

   vim /var/www/html/rconfig/.env

2. Add or modify the force-HTTPS variable.

   APP_FORCE_HTTPS=true

3. Configure trusted proxy headers if your proxy uses non-standard headers.

   # Add these lines to .env
   TRUSTED_PROXIES=*
   # Or specify specific proxy IP addresses:
   # TRUSTED_PROXIES=10.0.0.1,10.0.0.2

4. Save and exit. In vim, press Esc, type :wq, then press Enter.

5. Clear the application cache.

   php /var/www/html/rconfig/artisan config:clear
   php /var/www/html/rconfig/artisan cache:clear
   php /var/www/html/rconfig/artisan route:clear
   php /var/www/html/rconfig/artisan view:clear

6. Verify the application redirects HTTP to HTTPS or returns HTTPS-aware headers.

   curl -I http://your-domain.com

How do I verify the SSL setup?

Check the HTTPS response

curl -I https://your-domain.com

The headers should include:

HTTP/2 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-frame-options: DENY
x-content-type-options: nosniff

Check the HTTP to HTTPS redirect

curl -I http://your-domain.com

The response should be:

HTTP/1.1 301 Moved Permanently
Location: https://your-domain.com/

Validate the certificate

# View full certificate details
openssl s_client -connect your-domain.com:443 -servername your-domain.com | openssl x509 -noout -text

# Check expiration dates
echo | openssl s_client -servername your-domain.com -connect your-domain.com:443 2>/dev/null | openssl x509 -noout -dates

Online testing tools

• SSL Labs SSL Test for comprehensive SSL/TLS configuration analysis
• SSL Checker for quick certificate validation
• Mozilla Observatory for security headers and best practices

Generate an optimised config

Use the Mozilla SSL Configuration Generator to produce a tuned Apache SSL configuration for your version.

Common gotchas

Common SSL setup mistakes

• Apache fails to start after adding SSL. Run httpd -t (Rocky/RHEL) or apache2ctl configtest (Ubuntu) and read the error logs at /var/log/httpd/error_log or /var/log/apache2/error.log. The usual causes are a virtual host syntax error, wrong certificate paths, the SSL module not being loaded, or port 443 already in use. Check the port with ss -tlnp | grep :443.
• Permission denied on the certificate files. Apache logs a “Permission denied” handshake failure when ownership or modes are wrong. Reapply chmod 600 on the key, chmod 644 on the cert, set chown root:root on both, then restart Apache.
• SELinux blocks certificate access on RHEL-family systems even when permissions look correct. Run getenforce, check denials with ausearch -m avc -ts recent | grep httpd, then set the context: semanage fcontext -a -t httpd_sys_content_t "/etc/ssl/certs/rconfig.crt" and restorecon -Rv /etc/ssl/. Install policycoreutils-python-utils if semanage is missing.
• HTTPS works locally but not remotely. This is almost always the firewall or a cloud security group. Allow ports 80 and 443 with firewall-cmd or ufw, and check AWS, Azure, or GCP security group rules and load balancer settings.
• Let’s Encrypt validation fails. The domain must be publicly reachable on port 80 with correct DNS. Verify with dig +short your-domain.com, check /var/log/letsencrypt/letsencrypt.log, and use certbot --apache --staging while testing to avoid hitting the rate limit (5 certificates per domain per week).
• Self-signed certificate warnings in the browser are expected. Self-signed certificates are not trusted by browsers. For production use Let’s Encrypt; for internal use, add the certificate to the browser or organisation trust store.
• Certificate not renewing automatically. Test with certbot renew --dry-run, confirm the cron line exists with crontab -l | grep certbot, or check the timer with systemctl status certbot.timer on Ubuntu. Force a renewal with certbot renew --force-renewal if a certificate has already expired.

SSL maintenance best practices

• Disable outdated protocols (SSLv3, TLS 1.0, TLS 1.1) and serve only TLS 1.2 and TLS 1.3.
• Keep the security headers (HSTS, X-Frame-Options, X-Content-Type-Options) in your virtual host.
• Protect private keys with 600 permissions and never commit them to version control.
• Generate RSA keys of at least 2048 bits, or 4096 bits for long-lived certificates.
• Enable HTTP/2 over TLS to reduce page load times.
• Set an alert 30 days before any certificate expires and test the renewal path regularly.
• Use consistent certificate paths (/etc/ssl/private/, /etc/ssl/certs/) and descriptive names like rconfig-prod.crt.
• Include certificates and private keys in your backup procedures and store them securely offline.

Quick reference

Certificate file locations

OS Type	Private Key	Certificate	Apache Config
Rocky/RHEL/CentOS	/etc/ssl/private/rconfig.key	/etc/ssl/certs/rconfig.crt	/etc/httpd/conf.d/
Ubuntu	/etc/ssl/private/rconfig.key	/etc/ssl/certs/rconfig.crt	/etc/apache2/sites-available/

Common commands

Rocky/RHEL/CentOS

# Check Apache syntax
httpd -t

# View virtual hosts
httpd -S

# Restart Apache
systemctl restart httpd

# View error logs
tail -f /var/log/httpd/error_log

# Check certificate expiration
openssl x509 -in /etc/ssl/certs/rconfig.crt -noout -dates

# Test SSL connection
openssl s_client -connect your-domain.com:443

# Renew Let's Encrypt certificate
certbot renew --force-renewal

# Test certificate renewal
certbot renew --dry-run

Ubuntu

# Check Apache syntax
apache2ctl configtest

# View virtual hosts
apache2ctl -S

# Restart Apache
systemctl restart apache2

# View error logs
tail -f /var/log/apache2/error.log

# Check certificate expiration
openssl x509 -in /etc/ssl/certs/rconfig.crt -noout -dates

# Test SSL connection
openssl s_client -connect your-domain.com:443

# Renew Let's Encrypt certificate
certbot renew --force-renewal

# Test certificate renewal
certbot renew --dry-run

Certificate renewal schedule

Certificate Type	Validity Period	Renewal Frequency	Automation
Let’s Encrypt	90 days	Every 60 days	Automatic via cron or systemd
Self-Signed	User-defined (typically 365 days)	Before expiration	Manual
Commercial CA	1 to 2 years	30 days before expiration	Manual or vendor-specific

Firewall rules

firewalld (Rocky/RHEL)

# Add HTTP and HTTPS services
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

# Verify rules
firewall-cmd --list-services

# Add specific ports (alternative)
firewall-cmd --permanent --add-port=80/tcp
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --reload

UFW (Ubuntu)

# Allow HTTP and HTTPS
ufw allow 80/tcp
ufw allow 443/tcp
ufw reload

# Verify rules
ufw status

# Allow Apache Full (HTTP + HTTPS)
ufw allow 'Apache Full'

iptables

# Allow HTTP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow HTTPS
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Save rules (method varies by distribution)
# Rocky/RHEL/CentOS
iptables-save > /etc/sysconfig/iptables

# Ubuntu/Debian
iptables-save > /etc/iptables/rules.v4

What’s next

• Harden your rConfig V8 Core server for the full server-side security checklist
• Configure single sign-on once HTTPS is in place, since most SSO providers require it
• Tune the operating system for Apache, firewall, and supporting service configuration