How to reduce EC2 Data Transfer using ECC certificates into AWS
Tags: aws, ecc, datatransfer, ssl
Published: 2020-06-11 22:25:25

# What is ECC?

![](https://dev-to-uploads.s3.amazonaws.com/i/f908wg85m5j10ky4p78p.png)
<figcaption>The ECC’s main advantage is that you can have the smaller key size for the same level of security, in particular at high levels of security AES-256 ~ ECC-512 ~ RSA-15424 (algorithms for factoring, like the Number Field Sieve).</figcaption>


ECC is the latest encryption method. It stands for __Elliptic Curve Cryptography__ and promises stronger security, increased performance, yet shorter key lengths. This makes it ideal for the increasingly mobile world.

---

# How to reduce 20% Data Transfer in EC2 step by step and not die trying

---

Install Certbot:
![Alt text of image](https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/9054353648/original/nRieU8nUOqUfBca0A_sLEwlTbMhN9B4xog.png?1528814970)
[Certbot](https://certbot.eff.org/) is a fully-featured, extensible client for the Let’s Encrypt CA (or any other CA that speaks the ACME protocol) that can automate the tasks of obtaining certificates and configuring webservers to use them. This client runs on Unix-based operating systems.

---

First, go to measure the size of our RSA Certificate with the following command:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/5s48gy36b377bpm7ewoo.png)

---

#### Step 1: generate ECC key

```bash
mkdir ecc
cd ecc
openssl ecparam -name prime256v1 -genkey > key
```

#### Step 2: create a copy of OpenSSL config file

```bash
cp /etc/ssl/openssl.cnf domains.cnf
```

#### Step 3: editing config file

```bash
nano domains.cnf
```

Look for [ req ] section. Find add uncomment following line:

```bash
req_extensions = v3_req
```

If you don’t find a line like above, you can add one.
In <code>[ v3_req ]</code> section, add following line:

```bash
subjectAltName = @alt_names
```

It will look like:

```bash
[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
```

Finally add a new section called <code>[ alt_names ]</code> towards end of file listing all domain variation you are planning to use.

```bash
[ alt_names ]
DNS.1 = *.example.com
```

Now you have your OpenSSL config file ready.

#### Step 4: generate Certificate Signing Request

Next, we will generate CSR using private key above AND site-specific copy of OpenSSL config file.

```bash
openssl req -new -sha256 -key key -out csr -config domains.cnf
```

#### Step 5: use Certbot to deploying Let’s Encrypt certificates.

```bash
sudo certbot certonly --manual --key key --csr csr --preferred-challenges=dns --register-unsafely-without-email -d *.example.com
```

and it looks like:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/b51pmz1vtyk3cwcb7vsb.png)

#### Step 6: SSL Challenge
Now, go to Route 53, and find the Hosted Zone “application”. And then paste the value as TXT record:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/81s025a9x3e9evptlkaw.png)

Finally, they will see something like this:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/v03tni5vk0zkn2mqe9po.png)

The next step is to convert the key into a .pem:

```bash
openssl ec -in key -out key.pem
```

They should have this:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/wihhzlrvn0ui25i1r4wl.png)

Now, go to [AWS Console](https://console.aws.amazon.com/console/home) => [Load Balancers](https://console.aws.amazon.com/ec2/v2/home?region=us-east-1#LoadBalancers:sort=loadBalancerName) => Listeners => Upload a certificate to IAM.

Paste the following keys:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/wye2h95adenvsroxy09p.png)

Click to save and Enjoy!

--- 

Finally, we can check the size of ECC Certificate with the following command:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/7o3tgthfx24mxdyg3rkp.png)
<figcaption>SSL Certificate has been reduced 56%</figcaption>