How To Install Apache2 on Ubuntu 18.04 With Let’s Encrypt, HTTP/2, HSTS

As Ubuntu 16.04 LTS has been upgraded with new LTS version 18.04, we need to upgrade some of our older guides intended for relatively unused. In previous guide, we have shown steps to install Percona MySQL server on Ubuntu 18.04 LTS. Here is Detailed Guide on How To Install Apache2 on Ubuntu 18.04 With Let’s Encrypt, HTTP/2, HSTS With Commands and Configurations For Most Secured Setup. Of course, we have Apache2 installation guide for Ubuntu 16.04 With Let’s Encrypt, HTTP/2, HSTS as well. If you search our site with the keyword “Apache2”, you’ll get many optimization guides. We tried to keep this guide as easy yet detailed as possible.

We are assuming a 2GB RAM cloud server running LAMP (Apache, MyQL, PHP) and providing the settings. You should adjust the settings based on RAM and performance.

Steps To Install Apache2 on Ubuntu 18.04 With Let’s Encrypt, HTTP/2, HSTS

To install Let’s Encrypt free SSL/TLS certificate, you need to point the domain under question, for example jima.in to the server IP from DNS service you are using, like Hurricane Electric DNS, or paid DNS like Rage4 DNS or Dyn DNS. Make sure about DNS propagation. In an earlier article, we discussed about DNS CA record and example of Dyn DNS for implementation of DNS CA record. If you do not allow Let’s Encrypt from DNS, nothing will happen. But if you block Let’s Encrypt by not mentioning on DNS CA record, Let’s Encrypt tool will fail. There are various formats of TLS certificate, which are for the advanced users, like ECC SSL (ECDSA) Certificate. We are not showing such way but writing basic method which is enough robust. Definitely, you should try different tweaks later.

We will install Apache2 from Ondřej Surý’s PPA, which tweaked version :

Run :

Your OpenSSL will get upgraded from Ondřej Surý’s mixture formula. Now proceed to install Apache2 :

Active some needed modules :

Now, we need to add the PPA of Cert Bot (historically Cert Bot was Let’s Encrypt) :

Open :

Find the line KeepAlive (CTRL+W gives search option on Nano). The settings will be :

Here is reference :

Now open :

Apache has two main multi-processing module (MPM) – prefork module and event module. We are making prefork tweaked and activated. Keep the settings like below :

Disable the event module, enable prefork and restart Apache2 :

Now, go to /etc/apache2/sites-available/ and run an ls -al :

There will be two files – 000-default.conf and default-ssl.conf. Run cat command on each files, you’ll see the well documented examples. It is practical to copy the default files to meaningful ones:

You have to configure handle :

It is practical to have four files with understandable name for each. You can activate any configuration with this command :

You can deactivate any configuration with this command :

You have to reload following that action :

You can always test configuration with :

For one site, default /var/www/html directory is enough. For multiple sites, you need to create directories :(unless)

You can put some sample index.html page using nano inside that directory. Your directory path should reflect on configuration files like jima.in-ssl.conf.

This is a basic HTML page :

After those basic setup, you need to run this command to generate TLS certificate :

Now, let us edit that jima.in-ssl.conf file :

Now, if you test somewhere for HTTP/2, you’ll get it. For adding different headers, you need to activate a module :

Restart Apache2 to take effect :

Open /etc/letsencrypt/options-ssl-apache.conf file :

That file should look like this :

We will generate Diffie-Hellman key (the command will take time to end) :

We can wget this certificate for OSCP stapling :

You need to read our previous guides on HTTP Public Key Pinning (HPKP), previous Apache2’s guide, OCSP Stapling, OCSP Stapling error prevention etc articles.

Only run :

…after each changes you will add to configuration file like our jima.in-ssl.conf file.

That jima.in-ssl.conf file will look like this :

If you want Expect CT Header, then the block will look like :

Work slowly and make them working. After work, test on :

Of course you can use HTTP/2 server push feature with Apache2.

Always keep your settings files somewhere like on GitHub as repo. Unless you have whole server backup, their loss is a terrific loss. If you face trouble in setup, ask on StackExchange, ServerFault like Q&A sites pointing what step you have messed up. Apache2 is heavily used webserver and whole earth knows about common errors.