If you haven't heard of Let's Encrypt, check it out here.  In a nutshell, Let's Encrypt allows you to get a free SSL certificate for your personal site from a trusted CA, FOR FREE!  <applause here>

The process to install a Let's Encrypt certificate, and keep it renewed couldn't be simpler.  I've outlined here below.

Assumptions:

  1. You are running at least Amazon Linux AMI 03.2017
  2. You are using Apache as your web server.  You could use NGINX, but the file locations would be slightly different.
  3. Apache is currently using self signed certificates for SSL

 

Installing the SSL Certificates

Install Certbot and get the Certificates
  1. Log into your EC2 instance as ec2-user via SSH
  2. Download the certbot application, and make it executable
    1. wget https://dl.eff.org/certbot-auto
    2. sudo chmod a+x certbot-auto
  3. Run the certbot application to get your certificates.  This will execute a yum install for any necessary packages including PIP and Python
    1. sudo ./certbot-auto --debug -v --server https://acme-v01.api.letsencrypt.org/directory certonly -d Your_FQDN
  4. From here, Certbot will ask you several questions including where to validate with certbot (webroot, typically /var/www/html on Amazon Linux), and an administrative email.  This will place the certificate, private key, and chainfile onto your system.
    • Certificate File : /etc/letsencrypt/live/FQDN/cert.pem
    • Private Key : /etc/letsencrypt/live/FQDN/privkey.pem
    • Full Chain File : /etc/letsencrypt/live/FQDN/fullchain.pem
Configure Apache to use the new SSL Certificates
  1. Edit your SSL.conf file
    • sudo vi /etc/httpd/conf.d/ssl.conf
      1. Configure SSLCertificateFile to point to  /etc/letsencrypt/live/FQDN/cert.pem
      2. Configure SSLCertificateKeyFile to point to /etc/letsencrypt/live/FQDN/privkey.pem
      3. Configure SSLCertificateChainFile to point to /etc/letsencrypt/live/FQDN/fullchain.pem
  2. Restart your HTTPD process
    • sudo service httpd restart

 

That's all there is to it.  Now you have a fully trusted CA certificate protecting your websites SSL connections.  No more untrusted certificate browser errors for your site.  The next thing to do, would be to automate the certificate renewal process.  You can do that by adding the following line to your root user's crontab

  • 0 6 * * * /home/ec2-user/certbot-auto renew

This will have certbot renew your certificates everyday at 6am.