Introduction

Installing mod_ssl on Amazon Linux is the standard way to add HTTPS support to an Apache httpd server. The exact package command depends on whether the machine is running Amazon Linux 2 or Amazon Linux 2023, but the overall workflow is the same: install Apache if needed, install mod_ssl, configure certificates, open port 443, and restart the service.

Install Apache and mod_ssl

Start by confirming which Amazon Linux family you are using:

cat /etc/os-release

On Amazon Linux 2, the package manager is yum:

sudo yum update -y
sudo yum install -y httpd mod_ssl

On Amazon Linux 2023, the native package manager is dnf:

sudo dnf update -y
sudo dnf install -y httpd mod_ssl

Amazon Linux 2023 still supports yum as a compatibility wrapper, but using dnf makes the intent clearer.

After installation, start Apache and enable it at boot:

sudo systemctl enable --now httpd
sudo systemctl status httpd

What mod_ssl Adds

Installing mod_ssl typically places Apache SSL configuration under /etc/httpd/conf.d/ssl.conf. That file tells Apache to listen on 443 and points to the certificate and key files used for TLS.

You can verify that the SSL module is loaded with:

apachectl -M | grep ssl

If the module is active, you should see ssl_module in the output.

Configuring Certificates

For testing, a self-signed certificate is enough. For production, use a certificate from a trusted certificate authority.

A quick self-signed example looks like this:

1sudo openssl req -x509 -nodes -days 365 \
2  -newkey rsa:2048 \
3  -keyout /etc/pki/tls/private/server.key \
4  -out /etc/pki/tls/certs/server.crt

Then update the relevant lines in /etc/httpd/conf.d/ssl.conf:

SSLCertificateFile /etc/pki/tls/certs/server.crt
SSLCertificateKeyFile /etc/pki/tls/private/server.key

If your certificate provider gives you an intermediate chain file, configure that as well according to the Apache version and certificate instructions you are using.

Opening HTTPS Access

An Apache server can be configured correctly and still appear broken if the network rules block 443. On EC2, check the instance security group and any network ACLs.

At minimum, allow:

• TCP 80 for HTTP if you still want redirects or plain HTTP access
• TCP 443 for HTTPS
• TCP 22 for SSH administration

On the instance itself, if a host firewall is enabled, allow 443 there too.

Testing the Configuration

Before restarting Apache after certificate changes, test the configuration:

sudo apachectl configtest

If the result is Syntax OK, restart the service:

sudo systemctl restart httpd

Then verify HTTPS locally:

curl -k https://localhost/

The -k option is useful for self-signed certificates during testing. Remove it when validating a trusted certificate in production.

Production Considerations

For real public services, a self-signed certificate is not enough because browsers will warn users. Use a CA-signed certificate, automate renewals where possible, and review the TLS settings in ssl.conf rather than accepting every default blindly.

If the instance sits behind a load balancer that already terminates TLS, you may not need mod_ssl on the host itself. That architecture decision should be made before spending time on local Apache certificate management.

Common Pitfalls

One common mistake is following Amazon Linux 2 commands on an Amazon Linux 2023 host without realizing the package tooling changed. The package still exists, but the recommended command line differs.

Another issue is installing mod_ssl successfully and then forgetting to open port 443 in the EC2 security group. From the outside, that looks like Apache is misconfigured even though the service is healthy.

Certificate paths are another frequent source of failure. If SSLCertificateFile or SSLCertificateKeyFile points at the wrong file, Apache may fail configtest or refuse to start.

Finally, do not treat self-signed certificates as production-ready. They are fine for confirming that Apache and mod_ssl are wired correctly, but not for user-facing deployments.

Summary

• Install httpd and mod_ssl with yum on AL2 or dnf on AL2023.
• Use /etc/httpd/conf.d/ssl.conf to point Apache at the certificate and key.
• Verify the module with apachectl -M and the config with apachectl configtest.
• Open TCP port 443 in security groups and host firewall rules.
• Use self-signed certificates only for testing, not for production traffic.