SSL Toolkit Logo
Tools Features Compare FAQ Login
Ap

PEM/PFX to Apache Config

Convert your SSL certificate to a production-ready Apache VirtualHost configuration.

About

This tool converts your SSL certificate (PEM format or PFX/PKCS12) into a production-ready Apache VirtualHost configuration. It follows the Mozilla Server Side TLS guidelines — the same standards used by SSL Labs to grade servers.

The generated config includes SSL protocols, cipher suites, session settings, OCSP stapling, HSTS headers, and HTTP to HTTPS redirect. Simply paste your certificate or upload a PFX file, select a security profile, and get a copy-paste ready Apache config.

How to Use

  1. 1Upload your PEM certificate file or paste the data. You can also upload a PFX/PKCS12 file.
  2. 2If using PFX, enter the password in the PFX Password field.
  3. 3Select a security profile: Modern (TLS 1.3), Intermediate (TLS 1.2 + 1.3), or Old (legacy).
  4. 4Toggle features: HSTS, OCSP Stapling, HTTP to HTTPS redirect, HTTP/2.
  5. 5Click Generate Apache Config and copy or download the configuration.

Use Cases

✓New Apache server — Generate SSL config when deploying a new Apache server.
✓Certificate renewal — Update Apache config after renewing your SSL certificate.
✓SSL Labs A+ — Generate configs that earn an A+ grade on SSL Labs.
✓HSTS preload — Get Apache config with HSTS headers ready for preload submission.
✓PFX migration — Convert PFX certificate from IIS/Windows to Apache format.
✓Security hardening — Apply Mozilla recommended cipher suites to Apache.

Tips & Best Practices

  • •Use the Intermediate profile for most sites. Only use Modern if all clients support TLS 1.3.
  • •Enable OCSP Stapling — Apache fetches the OCSP response periodically, faster handshakes for clients.
  • •Use SSLCertificateChainFile for the intermediate CA bundle.
  • •Restart Apache after config changes: apachectl graceful
  • •Test config before restart: apachectl configtest
  • •Place cert and key in /etc/ssl/ or /etc/apache2/ssl/ with restrictive permissions.

Apache SSL Directives Explained

SSLCertificateFile / SSLCertificateKeyFile

Path to the fullchain certificate and private key files. Use absolute paths.

SSLProtocol

Specifies allowed TLS versions. Modern: -all +TLSv1.3. Intermediate: -all +TLSv1.2 +TLSv1.3.

SSLCipherSuite

Cipher suites allowed for handshake. Use HIGH:!aNULL:!MD5 for broad compatibility.

SSLUseStapling / SSLStaplingCache

Enables OCSP stapling. Server fetches and caches the OCSP response for faster handshakes.

Frequently Asked Questions

What files do I need for Apache SSL?

Apache requires the fullchain certificate (SSLCertificateFile), the private key (SSLCertificateKeyFile), and optionally the CA bundle (SSLCertificateChainFile). Download these files from this tool.

How do I enable OCSP stapling in Apache?

Enable SSLUseStapling On and set SSLStaplingCache in your VirtualHost. The intermediate CA certificate is required for verification.

How do I reload Apache after changing SSL config?

Run apachectl configtest to test the config, then apachectl graceful to apply changes without dropping connections.

Related Tools

All Servers

Configs for all 6 servers
Ng

PEM to Nginx

Nginx server block config
HA

PEM to HAProxy

HAProxy frontend config

SSL Checker

Verify your Apache config

SSL Converter

Convert cert formats

Cipher Ranking

Rank cipher suites