Using Let's Encrypt on AWS EC2 Instance
Tags: aws
Published: 2020-10-05 04:13:30

# Objectives

- Create a SSL certificate on your EC2 instance.
- We will not consider using php, maria-db on this EC instance (unlike in the documentation).

# Documentations

[Tutorial: Configure SSL/TLS on Amazon Linux 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/SSL-on-amazon-linux-2.html#ssl_prereq)

However, some of the instructions here in the documentation were outdated.

# Prerequisites

- Already launched an EC2 instance (in case of this situation, Amazon Linux 2)
- The EC2 security groups have ports 80, 443, and 22 open (http, https, and ssh respectively).
- Already have a domain created on Route 53 or somewhere else.

# Procedures

## Install apache on your EC2 machine

[Tutorial: Install a LAMP web server on Amazon Linux 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-lamp-amazon-linux-2.html)

```
$ sudo yum update -y
$ sudo yum install -y httpd
$ sudo systemctl start httpd
$ sudo systemctl enable httpd
$ sudo systemctl is-enabled httpd
```

## Create a localhost.crt

```
$ sudo yum install -y mod_ssl
$ cd /etc/pki/tls/certs
$ sudo ./make-dummy-cert localhost.crt
```

Do **not** comment out the `SSLCertificateKeyFile /etc/pki/tls/private/localhost.key`, although it says so in the documentation. Otherwise, you will get an error when running apache (reason unknown).

I actually do not know whether this localhost.crt is even necessary.

## Install and run certbot 

```
$ sudo wget -r --no-parent -A 'epel-release-*.rpm' http://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/
$ sudo rpm -Uvh dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-*.rpm
$ sudo yum-config-manager --enable epel*
```

Add the following lines in your `/etc/httpd/conf/httpd.conf` and after `Listen 80`, insert the following.

```
<VirtualHost *:80>
    DocumentRoot "/var/www/html"
    ServerName "example.com"
    ServerAlias "www.example.com"
</VirtualHost>
```

Restart apache, install certbot, and run it.

```
$ sudo systemctl restart httpd
$ sudo yum install -y certbot python2-certbot-apache
$ sudo certbot
```

Agree to the terms.

```
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A
```

Choose the domain names you want to activate.

```
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: example.com
2: www.example.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
```

After this, answer to a couple of questions, and you should be done!

```
Congratulations! You have successfully enabled https://example.com and
https://www.example.com

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=example.com
https://www.ssllabs.com/ssltest/analyze.html?d=www.example.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/certbot.oneeyedman.net/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/certbot.oneeyedman.net/privkey.pem
   Your cert will expire on 2019-08-01. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
```

You can see your certificates, private key, and chain at `/etc/letsencrypt/live/certbot.oneeyedman.net`. You can import these into your Amazon Certificate Manager, and use it for your Elastic Load Balancers.

## P.S.

- There are other ways to install certbot apart from `sudo yum install`, such as `curl`. I followed the AWS docs on this one.
- But in case of using `curl`, you will have to configure the settings so that it matches the requirements of Amazon Linux 2.