New Zabbix Implementation - Trying to configure SSL on Apache

[TeeJay13]

Zabbix Version: 7.2
OS: Ubuntu
OS Version: 24.04 Noble
Zabbix Component: Server, Frontend
Web Server: Apache

We have been trying to configure SSL on Ubuntu. I've been looking online and the best link / guide i've found is this reddit post (https://www.reddit.com/r/zabbix/comm...ssl_on_ubuntu/)
I have the certs uploaded i've follwoed all the steps below:

2- Install SSL Module: Make sure you have the SSL module installed.

sudo a2enmod ssl

3- Copy Certificate and Key Files: Place your .crt and .key files in the appropriate directories (usually /etc/ssl/certs/ for the certificate and /etc/ssl/private/ for the key).

sudo cp /path/to/your_certificate.crt /etc/ssl/certs/

sudo cp /path/to/your_private.key /etc/ssl/private/

4- Update Apache Configuration: Edit your Apache configuration file (/etc/apache2/sites-available/000-default.conf) to include the path to your SSL certificate and key. Your configuration should include something like this:

<VirtualHost *:443>

ServerName your-zabbix-server-name

SSLEngine on

SSLCertificateFile /etc/ssl/certs/your_certificate.crt

SSLCertificateKeyFile /etc/ssl/private/your_private.key

DocumentRoot /usr/share/zabbix

<Directory "/usr/share/zabbix">

Options FollowSymLinks

AllowOverride None

Require all granted

</Directory>

</VirtualHost>

Make sure to replace your-zabbix-server-name, your_certificate.crt, and your_private.key with your actual server name and certificate files.

5- Restart Apache: Restart the Apache service for changes to take effect.

sudo systemctl restart apache2




When I do the restart for apache that is where this fails and I have to revert the changes. Any help would be very appreciated.

[Hamardaban]

The certificate and key must be in base64 PEM format.(openssl x509 -inform der -in domain.der -out domain.crt)
The key must be decrypted. (openssl rsa -in encrypted.key -out decrypted.key)

Check for match cert & key:
openssl x509 -noout -modulus -in server.crt | openssl md5
openssl rsa -noout -modulus -in server.key | openssl md5

[TeeJay13]

This has been resolved... it was user error, the steps above I posted were correct just helps if you have the correct key...