What has to be configured to make Apache serve a site over HTTPS only, and why each step?

Point the SSL site at the certificate and private key, enable mod_ssl and the SSL site, redirect plain HTTP to HTTPS permanently, then restart.

1. Put the files in place: certificate in /etc/ssl/certs/www.cer, private key in /etc/ssl/private/www-private.key (root-only).
2. Configure the TLS virtual host in default-ssl.conf:

   ServerName            www.gXXX.ckteck.com
   SSLCertificateFile    /etc/ssl/certs/www.cer
   SSLCertificateKeyFile /etc/ssl/private/www-private.key
   

   The server sends the certificate in the handshake and proves it holds the private key.
3. Enable TLS: a2enmod ssl loads mod_ssl (not active by default on Debian), a2ensite default-ssl activates the port-443 site.
4. Close plain HTTP: in the port-80 virtual host (000-default.conf), Redirect permanent / https://www.gXXX.ckteck.com/. A permanent (301) redirect sends every HTTP request to the HTTPS URL, so nobody keeps using the unencrypted site by accident.
5. systemctl restart apache2 to load the new configuration.

A redirect alone still lets the very first request go out unencrypted, where it could be intercepted. Public sites add HSTS (Strict-Transport-Security header) so the browser goes straight to HTTPS on later visits.

Before Let's Encrypt and certbot, obtaining a certificate by hand like this was the only way. Doing it manually here shows each cryptographic step that certbot automates.

Go deeper:

• Apache: mod_ssl reference — SSLCertificateFile, SSLCertificateKeyFile and the rest of the TLS directives.
• Wikipedia: HTTP Strict Transport Security — why a redirect alone leaves the first request exposed.