Assumptions

all web files are installed in the /var/www/domain/html folder, and owned by www-data

the domain is set up as a virtual host / site as described in the Configuration Files below

Configuration Files

/etc/apache2/apache2.conf

...

<Directory />
       Options FollowSymLinks SymLinksIfOwnerMatch
       AllowOverride None
       Require all denied
</Directory>

<Directory /usr/share>
       AllowOverride None
       Require all granted
</Directory>

<Directory /var/www>
       Options +FollowSymLinks +SymLinksIfOwnerMatch
       AllowOverride None
       Require all denied
</Directory>
...

/etc/apache2/sites-available/domain.conf

<VirtualHost *:80>

       ServerName domain
       ServerAlias www.domain

       ServerAdmin webmaster@localhost
       DocumentRoot /var/www/domain/html

      #
       # Set up logging
      #

       LogLevel info ssl:warn
       ErrorLog ${APACHE_LOG_DIR}/error-vizier.uk.log
       CustomLog ${APACHE_LOG_DIR}/access-vizier.uk.log combined

       RewriteEngine on

      #
       # Add Settings for directories
       #

       <Directory "/var/www/domain/html">
               AllowOverride All
               Require all granted
               Options -Indexes -MultiViews +FollowSymLinks +SymLinksIfOwnerMatch
               <Files ~ \.pl$>
                       SetHandler cgi-script
                       Options ExecCGI
               </Files>
               AddHandler cgi-script .pl
       </Directory>

#
# http -> https redirects
#

       RewriteEngine on
       RewriteCond /var/www/flags/apache2-disable-ssl-redirects !-f
       RewriteCond %{SERVER_NAME} =domain [OR]
RewriteCond %{SERVER_NAME} =domain.uk
       RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

Notes

The RewriteEngine requires the FollowSymLinks option, which must be set on the / folder.

The DocumentRoot folder must have a Directory entry.

Enabling SSL (With LetsEncrypt)

TO enable SSL, create the virtual server as described above, and ensure that the web site / folder exists.

Enable the website:

a2ensite domainname

Start the server with:

systemctl start apache2

And ensure that there are no errors (try 'systemctl status apache2')

Ensure that 'certbot' is installed, then set up the SSL virtual service as follows:

# Temporairily Disable SSL
sudo /bin/rm -f /var/www/flags/apache2-enable-ssl

      # Install SSL
       sudo certbot \
               --apache \
               -w /var/www/domainname/html \
               --preferred-challenges http \
               --email webmaster@localhost \
               --agree-tos \
               -v \
               -d domainname www.domainname

       # Re-enable SSL
       sudo touch /var/www/flags/apache2-enable-ssl

Ensure that port 443 is open in the firewall, and

Finally, re-start the apache server:

systemctl restart apache2

Scripts

Install SSH

#!/bin/bash
#
#

echo ""
echo "enable-https: Enabling ssl for all running websites:"
(cd /etc/apache2/sites-enabled ; ls *.conf | grep -v default | grep -v ssl | cut -d- -f2- | sed -e "s/\.
conf$//g" | sed -e "s/^/\t/g")
echo ""

sleep 2

sudo apt install certbot python3-certbot-apache

LIST=`ls /etc/apache2/sites-enabled/*.conf | grep -v default.conf | grep -v ssl`

for conf in $LIST; do

       echo ""
       echo "-------------------------------------------------------------"
       echo ""
       echo "PROCESSING $conf"

       hostname=`grep -h ServerName $conf | grep -v \# | sed -e "s/[\t ]*ServerName[\t ]*//g"`
       ALIASLIST=`grep -h ServerAlias $conf | grep -v \# | sed -e "s/[\t ]*ServerAlias[\t ]*//g" | sed
-e "s/^/-d /g"`

       sslconf=`echo $conf | sed -e s/\.conf$/-ssl.conf/g`
       if [ -f "$sslconf" ]; then
               echo "REMOVING $sslconf"
               sudo rm -f /etc/apache2/sites-enabled/*-$hostname-ssl*.conf
       fi

       # --dry-run
       # --authenticator webroot

       # Temporairily Disable SSL
       #sudo /bin/rm -f /var/www/flags/apache2-enable-ssl

       # Install letencrypt certificate using http web requests
       echo "Running certbot install for /var/www/$hostname/html ($hostname $ALIASLIST)"
       sudo certbot \
               --apache \
               -w /var/www/$hostname/html \
               --preferred-challenges http \
               --email webmaster@localhost \
               --agree-tos \
               -v \
               -d $hostname $ALIASLIST

       # Re-enable SSL
       sudo touch /var/www/flags/apache2-enable-ssl
done

sudo systemctl restart apache2