After creating a SSL certificate, I had to invite Apache to the party. My vhost configuration looks roughly like this:
# This may be needed on another server one day:
#LoadModule ssl_module modules/mod_ssl.so
# According to Stack Overflow, we HAVE to use "NameVirtualHost IP:443", but I didn't need it:
#NameVirtualHost 11.22.33.44:443
<VirtualHost  11.22.33.44:443>
	ServerName www.domain.com
	ServerAdmin webmaster@domain.com
	DocumentRoot /srv/www/domain.com/htdocs/
	CustomLog    /srv/www/domain.com/logs/access.log common
	ErrorLog     /srv/www/domain.com/logs/error.log
	# This alias keeps the document root clean (This is not really part of the web site)
	Alias /srv/www/domain.com/htdocs/.well-known/acme-challenge/ /srv/www/domain.com/ssl/
	Alias /srv/www/domain.com/htdocs/stats/ /srv/www/domain.com/stats/
	# emerg/alert/crit/error/warn/notice/info/debug/trace1/.../trace8
	LogLevel warn
	# Make sure, Apache can access the following files:
	SSLEngine On
	SSLCertificateFile      "/srv/www/domain.com/ssl/www.domain.com.crt"
	SSLCertificateKeyFile   "/srv/www/domain.com/ssl/www.domain.com.key"
	SSLCertificateChainFile "/srv/www/domain.com/ssl/chain.crt"
	<Directory /srv/www/domain.com/htdocs/>
		Options +FollowSymLinks +Indexes
		AllowOverride All
		Order allow,deny
		Allow from all
		Require all granted
		#<FilesMatch "\.php[345]?$">
		#	SetHandler php-fcgi
		#</FilesMatch>
	</Directory>
</VirtualHost>
<VirtualHost 5.132.159.80:80>
        ServerName www.domain.com
	Redirect permanent / https://www.domain.com/
</VirtualHost>
On a server, that has ISPConfig installed, I had to comment out "Alias /.well-known/acme-challenge/ /usr/local/ispconfig/interface/acme/.well-known/acme-challenge/" in /etc/apache2/sites-enabled/000-ispconfig.conf in order to get past ISPConfig's stubborness and let everyone access this folder in MY document_root. Users have no access to ISPCongigs' folder!?