Ubuntu – Best practices for placing SSL certificates for use in Apache 2

apache-2.2debiansslUbuntu

In an environment where a handful of Apache servers are running a bunch of sites using SSL certificates for HTTPS, where should these certificates be placed? In Debian or Ubuntu, should all relevant files be put in /etc/apache2/ssl? Or is there some other location better suited for this? What security concerns should be addressed when choosing locations for these files for multiple websites on the same server?

Best Answer

FWIW, I use Debian.

I place all private keys in /etc/ssl/private which has permission mode 0700. I place all certificates in /etc/ssl/certs which has permission mode 0755. The owner/group for both is root:root.