---
title: "How to configure Apache"
slug: "certificate-manager-configure-apache"
updated: 2026-11-06T15:16:46Z
published: 2026-11-06T15:16:46Z
canonical: "docs.senhasegura.io/certificate-manager-configure-apache"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# How to configure Apache

This document provides information on how to configure the Apache publishing profile to make it possible to install and publish certificates.

## Requirements

- An Apache server with SSL parameters activated.
- A certificate generated and signed by a CA. More information in [How to create a request](/v4-2/docs/certificates-flow-how-to-requisitions) and [How to sign a request](/v4-2/docs/certificates-flow-how-to-sign-request).
- A local credential on the Apache server with read and write permissions in the following directories:
  - `/etc/ssl/certs/`
  - `/etc/ssl/private/`
- A credential registered in Segura™ with the IP address or domain of the Apache server. More information on how to configure a credential in Segura™ in [How to configure a credential in Segura™](/v4-2/docs/pam-credential-how-to-set-up-a-credential-in-senhasegura).

## Configure Apache

To configure Apache, see the following steps:

1. On Segura™, in the navigation bar, hover over the **Products** menu and select **Certificate Manager**.
2. In the side menu, select **Publishing** > **Publishing profiles**.
3. In the actions button, select **Apache**.
4. In the **Settings** tab, enter the following information:
  1. In the **Profile name ***, enter the profile's name.
  2. In the **Credential username**, enter the credentials' name.
  3. (Optional): Check the **Use a registered credential to access all devices** option and, in the **Access credential registered in the system**, select the access credential registered in Segura™ to be used.
5. Click **Continue**.
6. In the **Apache** tab, enter the following fields:
  1. In the **Site** field, enter the name of Apache's server configuration file. For example: `default-ssl.conf`. This field is not used to publish: Segura® uses only the **Configuration file path** field.
  2. In the **Configuration file path** field, enter the full path of the configuration file. For example: `/etc/apache2/sites-available/default-ssl.conf`.
  3. In the **Port** field, enter the port where Apache serves the certificate. The default is `443`. Segura® uses this port only for the post-publication check.
7. Click **Continue**.
8. In the **Devices** tab, select the Apache server.
  1. The device must be previously registered in Segura™.
  2. The **Network Connector** column shows **Yes** or **No**, depending on whether the device has its own Network Connector agent configured.
9. In the **Review** tab, review all information entered previously, and click **Save**.

## Post-publication check

After installing the certificate, Segura® connects to the server on the port entered in the **Port** field and compares the fingerprint of the certificate the server presents with the fingerprint of the published certificate:

- If the fingerprints match, the publication succeeds.
- If the fingerprints differ, the publication fails with the error `Fingerprint comparison failed`.
- If Segura® cannot connect to the server, the publication still ends successfully. The execution log records that Segura® could not communicate with the server on that port.

The check connects only over TLS 1.2. Through a Network Connector, it connects to `127.0.0.1:<port>` on the server, without SNI. Through a direct connection, it connects to the device's hostname.

Attention

Use only one SSL site per configuration file and port. Segura® updates only the first uncommented `SSLCertificateFile` directive in the configuration file. With several SSL virtual hosts on the same port, the check through a Network Connector does not reach the virtual host that serves the new certificate, and the publication fails with the error `Fingerprint comparison failed`, even though the new certificate is in use.

## Network Connector behavior

Apache publishing uses the Network Connector configured on the device for both the installation and the post-publication check. The execution log shows the route each step used: `Network Connector: <agent>` for the installation, and `TLS verification via Network Connector` or `TLS verification: direct connection to <host>:<port>` for the check.