Add SSL to XAMPP installation

Add a free SSL certificate to XAMPP on Windows

This guide explains how to install a free SSL certificate in XAMPP on Windows without creating an incomplete certificate chain.

Before you begin

Make sure:

1. ports 80 and 443 are forwarded to the Windows computer running XAMPP;
2. Windows Firewall allows inbound TCP traffic on ports 80 and 443;
3. your domain points to the correct public IP address;
4. Apache is running and your website is accessible over HTTP.

UDP rules are not required for a standard Apache HTTPS configuration.

1. Request the certificate

Request a certificate from ZeroSSL, Let’s Encrypt or another trusted certificate authority.

Complete the requested domain verification, such as adding a DNS TXT record. Download and extract the certificate files when verification has finished.

You will normally receive:

certificate.crtca_bundle.crtprivate.key

Keep private.key secure. Never publish or share this file.

2. Create a complete certificate chain

Apache must send both your website certificate and the intermediate CA certificates. Using only certificate.crt can cause an “incomplete certificate chain” warning.

Open Command Prompt and go to the directory containing the downloaded files:

cd /d "%USERPROFILE%\Downloads"

Combine the certificate and CA bundle in the correct order:

copy /B certificate.crt+ca_bundle.crt server.crt

The resulting server.crt contains:

1. your website certificate;
2. the required intermediate CA certificate or certificates.

3. Install the files in XAMPP

First, back up any existing certificate and key files.

Copy the complete certificate chain:

copy server.crt C:\xampp\apache\conf\ssl.crt\server.crt

Copy the private key:

copy private.key C:\xampp\apache\conf\ssl.key\server.key

If XAMPP is installed elsewhere, adjust the paths accordingly.

4. Configure Apache

Open:

C:\xampp\apache\conf\extra\httpd-ssl.conf

Find the SSL virtual host and configure it for your domain:

<VirtualHost *:443> ServerName example.com ServerAlias www.example.com
SSLEngine on
SSLCertificateFile "C:/xampp/apache/conf/ssl.crt/server.crt" SSLCertificateKeyFile "C:/xampp/apache/conf/ssl.key/server.key"
DocumentRoot "C:/xampp/htdocs"</VirtualHost>

Replace example.com with your domain.

Use forward slashes in Apache’s Windows paths. The configuration filename is httpd-ssl.conf, not httpd-ssl.cfg.

Also verify that the following line is enabled in:

C:\xampp\apache\conf\httpd.confInclude conf/extra/httpd-ssl.conf

Remove the leading # if the line is commented out.

5. Test the configuration

Before restarting Apache, run:

C:\xampp\apache\bin\httpd.exe -t

Apache should respond with:

Syntax OK

If an error is displayed, correct it before restarting Apache.

6. Restart Apache

Stop and start Apache using the XAMPP Control Panel. Then visit:

https://example.com

Verify the installation with the Qualys SSL Labs Server Test.

Under Certificates provided, the report should normally show at least two certificates. If it shows only one and reports “Chain issues: Incomplete”, verify that server.crt contains both certificate.crt and ca_bundle.crt.

7. Renew the certificate

Free certificates usually have a limited validity period. Renew the certificate before it expires.

After renewal:

1. create a new server.crt from the new certificate.crt and ca_bundle.crt;
2. replace the existing certificate and private-key files;
3. test the Apache configuration;
4. restart Apache;
5. run another SSL Labs test.

Never reuse an old ca_bundle.crt without checking whether the certificate authority supplied a newer one.