diff --git a/certbot-apache/certbot_apache/_internal/http_01.py b/certbot-apache/certbot_apache/_internal/http_01.py
index 211fda0bf..ca73a18e9 100644
--- a/certbot-apache/certbot_apache/_internal/http_01.py
+++ b/certbot-apache/certbot_apache/_internal/http_01.py
@@ -24,10 +24,10 @@ class ApacheHttp01(common.ChallengePerformer):
     """Class that performs HTTP-01 challenges within the Apache configurator."""
 
     CONFIG_TEMPLATE24_PRE = """\
-        RewriteEngine on
         RewriteRule ^/\\.well-known/acme-challenge/([A-Za-z0-9-_=]+)$ {0}/$1 [END]
     """
     CONFIG_TEMPLATE24_POST = """\
+        RewriteEngine on
         <Directory {0}>
             Require all granted
         </Directory>
diff --git a/certbot-apache/certbot_apache/_internal/tests/http_01_test.py b/certbot-apache/certbot_apache/_internal/tests/http_01_test.py
index 3ba34f3fa..20e096b21 100644
--- a/certbot-apache/certbot_apache/_internal/tests/http_01_test.py
+++ b/certbot-apache/certbot_apache/_internal/tests/http_01_test.py
@@ -209,7 +209,7 @@ class ApacheHttp01Test(util.ApacheTest):
         with open(self.http.challenge_conf_post) as f:
             post_conf_contents = f.read()
 
-        assert "RewriteEngine on" in pre_conf_contents
+        assert "RewriteEngine on" in post_conf_contents
         assert "RewriteRule" in pre_conf_contents
 
         assert self.http.challenge_dir in post_conf_contents
diff --git a/certbot/CHANGELOG.md b/certbot/CHANGELOG.md
index 8d7cb4e80..5dadb384f 100644
--- a/certbot/CHANGELOG.md
+++ b/certbot/CHANGELOG.md
@@ -17,7 +17,9 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 
 ### Fixed
 
-*
+* Moved `RewriteEngine on` directive added during apache http01 authentication
+  to the end of the virtual host, so that it overwrites any `RewriteEngine off`
+  directives that already exist and allows redirection to the challenge URL.
 
 More details about these changes can be found on our GitHub repo.