Fix Apache’s “Invalid command SSLEngine” error

Apache recognizes SSLEngine only when mod_ssl is loaded. An Invalid command 'SSLEngine' error usually means that module is absent or not enabled in the configuration Apache is reading.

Install or enable the module using your distribution's mechanism, validate the configuration, then reload the correct service. Loading the module does not itself configure a working HTTPS listener or certificate.

Enable mod_ssl

On RHEL, Fedora, and related systems:

sudo dnf install mod_ssl
sudo apachectl configtest && sudo systemctl reload httpd

Older systems may use yum instead of dnf.

On Debian or Ubuntu:

sudo a2enmod ssl
sudo apachectl configtest && sudo systemctl reload apache2

If the service is stopped because its configuration previously failed, start it after the configuration test passes; a reload requires a running service. Custom installations may use different executable and service names.

Confirm the module is loaded

apachectl -M | grep ssl
# Expected module: ssl_module
apachectl configtest
# Expected result: Syntax OK

Use the control script and configuration belonging to the Apache instance you actually run. Inspect startup errors if the module cannot load, including missing dependencies.

SSLEngine is a directive supplied by mod_ssl. Similarly, ProxyPass requires mod_proxy, and RewriteEngine requires mod_rewrite. Apache rejects an unknown directive during configuration parsing; it cannot apply a directive from an unloaded module.

Complete the HTTPS configuration

Make sure a global Listen 443 already exists, adding it only if necessary. This virtual-host fragment assumes the listener and required modules are configured:

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile    /etc/ssl/certs/server-fullchain.pem
    SSLCertificateKeyFile /etc/ssl/private/server.key
    DocumentRoot /var/www/html
</VirtualHost>

For supported Apache versions, the certificate file can contain the leaf followed by the required intermediates. Check the paths, PEM encoding, key pairing, and permissions. The identity loading the key must be able to read it, while other users should not.

After a successful configuration check and reload, request the real HTTPS hostname and verify both the certificate and the expected HTTP response. A Guance HTTP test can continue checking that URL and its expected status.

Common questions

Why does a2enmod say the ssl module does not exist?

Check whether the distribution's Apache installation is complete and whether you are mixing a custom installation with distribution tools. Debian/Ubuntu normally supply the module through their Apache packages; sudo apt install apache2 can install the standard package set. Inspect package contents and module paths if a customized installation still lacks it.

Why does Apache now report a certificate-file error?

Enabling the module exposed the next configuration problem. Check SSLCertificateFile, SSLCertificateKeyFile, file existence, encoding, ownership, and whether the key matches the certificate. Do not loosen private-key permissions broadly to make the error disappear.

How do I enable TLS in a container?

Check the actual image's loaded modules with httpd -M and inspect its module directory and configuration. An unloaded module is not necessarily an uncompiled module. Follow the image's instructions for mod_ssl, dependencies, a listener, and certificate mounts. You can also terminate TLS at a reverse proxy, provided the upstream protocol and security boundary are deliberate.

See Apache mod_ssl and the official httpd image source.