Install SSL certificate on your mac server [renewal procedure updated]

What is SSL?

SSL (Secure Sockets Layer) is a standard security technology for establishing an encrypted connection between a web server and a browser. SSL uses a combination of public key and symmetric key encryption to secure a connection between two machines. Typically, if a website wanted to encrypt data transmission between the server and the client, we need to purchase a SSL certificate that contains an encryption key that is placed on the server.

Why SSL encryption?

A part from security problems discussed above, there are many reasons you would need a SSL encryption.

As of January 1st 2017 SSL Encryption is now a ranking factor in Google’s Algorithm. Furthermore Chrome and Firefox will display a warning for any non secure HTTP page that contains a password field. Chrome’s warning will be more severe – on the left-hand side of the address bar it will read “Not Secure.” As a website owner, you need to consider the effects of your web users seeing that your site is “Not Secure”.

How to migrate from HTTP to HTTPS on your mac?

I will help you to perform a good configuration on your mac server in order to support https on your websites. You don’t need money in order to get this works but you need little knowledge of mac programming an a bit of patience. This procedure was firstly developed by Edwin Andino but here I reported the final working version with slight modifications (especially for certificate conversion and install).

FIRST STEP: Get a SSL certificate

SSL Certificates need to be issued from a trusted Certificate Authority. Usually, browsers and operating systems get a list of trusted CA root certificates.

You can buy certificate from different authority (the cost starts from 30€) such as GlobalSign, DigiCert, and go on. A complete list of trusted certificate authority is also supplied from Apple. Otherwise, you can get it for free from Let’s Encrypt. Let’s Encrypt is a free and open certificate authority brought to you by the non-profit Internet Security Research Group.

SECOND STEP: Install “let’s Encrypt” certificate with Homebrew

In order to install Let’s Encrypt certbot, you need Homebrew configured on your mac. You can find the correct procedure here. Open Terminal app and use following code:

brew update

sudo mkdir /etc/letsencrypt

sudo mkdir /var/lib/letsencrypt

sudo mkdir /var/log/letsencrypt

brew install letsencrypt

THIRD STEP: get certificate from Le’s Encrypt

You have to use these simple codes in order to get the certificate. Please change general website name ( with yours. Take care of folder directory of your web sites (mine is /Library/WebServer/Documents/)

sudo letsencrypt certonly –webroot -w /Library/WebServer/Documents/ -d

You can also get one certificate for multiple sudomain:

sudo letsencrypt certonly –webroot -w /Library/WebServer/Documents/ -d -d -d

or multiple domain:

sudo letsencrypt certonly –webroot -w /Library/WebServer/Documents/ -d -w /Library/WebServer/Documents/ -d

Terminal app will ask your email address. Your email will be important in order to register your certificate. Furthermore, you will receive expiry notices when your certificate is coming up for renewal (20 days before your certificate expires, and more notices at 10 days and 1 day before it expires) or  security notices

Then you have to agree Term of service (choose “a”).

Please read the Terms of Service at You must agree
in order to register with the ACME server at

After this, you’ll get the certificate.

NOTE: if something goes wrong you’ll receive and error like “Failed authorization procedure” with a simple description.

FOURTH STEP: Convert and import certificate to Apple Keychain

At this point you have to convert your certificate (.pem to .p12) in order to be Apple Keychain compatible. Use this simple code in terminal Please change general website name ( with yours.

sudo openssl pkcs12 -export -inkey /etc/letsencrypt/live/ -in /etc/letsencrypt/live/ -certfile /etc/letsencrypt/live/ -out /etc/letsencrypt/live/ -passout pass:YOUR_PASSWORD_HERE

after this, install your certificate into Apple Keychain and Server App:

sudo security import /etc/letsencrypt/live/ -f pkcs12 -k /Library/Keychains/System.keychain -P \YOUR_PASSWORD_HERE -T /Applications/

You’ll receive confirmation regarding identity and certificate import

FIFTH STEP: Change your website setting into SSL

Open Server app (or relaunch in case it is open) and click on “websites”. Select your website and choose SSL certificate from Let’s Encrypt Authority X3. The port should automatically change to 443. Click OK in order to save changes


RENEW YOUR CERTIFICATE [Update April 8, 2017]

You have to remember that Let’s encrypt certificate expires in 3 months. However you’ll receive an email notification upon expiration.

In order to renew your certificate you have to use Terminal:

sudo certbot renew

After this, you have to repeat step 4 in order to load new certificate into your Keychain. Close and open again You’ll find two Let’s Encrypt certificates (different expiration date). Choose the new certificate for all your services.

At this point you have to remove old certificate. Open (in Application/Utilities), and find your certificates under “System  keychain”. You have to remove the certificate already expired or is going to expire.

Close and open again and voilà: new certificate and SSL services correctly working with it.