AWS Lightsail and Let’s Encrypt SSL certificate

Creating and installing a Let’s Encrypt SSL certificate for your WordPress installation

An Introduction to SSL and Certificates

First of all: SSL stands for ‘Secure Sockets Layer’ and ensures that data is transmitted in encrypted form. However, there is plenty of information on the subject of SSL available via search engines, so we won’t go into any further detail here. The reason for having an SSL certificate is simply that it allows your website to be accessed via HTTPS, which is very important these days for the sake of user security. It’s also absolutely essential for the SEO optimisation of your website.

Let’s Encrypt helps us with this, as it is a free, automated and open certificate authority through which we can obtain an SSL certificate.

This article will guide you, firstly, through the process of creating a Let’s Encrypt certificate for your domain and, secondly, through the installation and configuration of your WordPress website on AWS Lightsail.

Requirements for setting up SSL

This article assumes the following:

• You have installed your WordPress website on an AWS Lightsail instance, and it can be accessed via a public domain
• Of course, this assumes that you have your own domain and that it points to the public IP address of your WordPress website
• You have the necessary login details for your AWS Lightsail instance

Procedure for obtaining an SSL certificate

First and foremost: there are various ways – and in some cases simpler ones – to make your website accessible via https. However, the following method has always worked for us, which is why we want to show you exactly this approach in this article. If you have any comments or suggestions for improvement, please leave a brief comment and we’ll get back to you as soon as possible!

Step 1 – Installing the Lego client

The Lego client simplifies the process of creating an SSL certificate and involves the following steps:

• Log in to the AWS Lightsail instance console – https://lightsail.aws.amazon.com/ls/webapp/home/instances
• Run the following code to install the client (PLEASE NOTE: ‘A.B.C’ is a placeholder and should be replaced with the latest version available on the website):

cd /tmp
curl -Ls https://api.github.com/repos/xenolf/lego/releases/latest | grep browser_download_url | grep linux_amd64 | cut -d '"' -f 4 | wget -i - 
tar xf lego_vA.B.C_linux_amd64.tar.gz
sudo mkdir -p /opt/bitnami/letsencrypt
sudo mv lego /opt/bitnami/letsencrypt/lego

At the time this article was written, the version was as follows: lego_v3.0.2_linux_amd64.tar.gz

These steps will download the client to a temporary folder, extract it and move it to the correct folder.

Step 2: Generating the Let’s Encrypt certificate for your domain

The following steps will guide you through the process of creating a certificate for your domains.

• Shutting down all Bitnami services:

sudo /opt/bitnami/ctlscript.sh stop

• Requesting a new certificate for your domain – with and without the www prefix. PLEASE NOTE: Remember to replace the DOMAIN and EMAIL ADDRESS placeholders with your own details:

sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADRESSE" --domains="DOMAIN" --domains="www.DOMAIN" --path="/opt/bitnami/letsencrypt" run

This results in the following code on our page:

sudo /opt/bitnami/letsencrypt/lego --tls --email="info@goldenwebage.de" --domains="goldenwebage.de" --domains="www.goldenwebage.de" --path="/opt/bitnami/letsencrypt" run

• Acceptance of the Terms of Service

Once the certificate has been generated, it can be found in the following folder: /opt/bitnami/letsencrypt/certificates.

Step 3: Configuring your web server with the Let’s Encrypt certificate

The next step is to inform the web server of the new certificate.

• Link the new SSL certificate and the key file to the correct locations on your web server (depending on the server’s configuration). Please remember to replace the DOMAIN placeholder with your actual domain. TIP: You can find the current configuration using the following command: sudo /opt/bitnami/ctlscript.sh status.

Web server – Apache:

sudo mv /opt/bitnami/apache2/conf/server.crt /opt/bitnami/apache2/conf/server.crt.old
sudo mv /opt/bitnami/apache2/conf/server.key /opt/bitnami/apache2/conf/server.key.old
sudo mv /opt/bitnami/apache2/conf/server.csr /opt/bitnami/apache2/conf/server.csr.old
sudo ln -sf /opt/bitnami/letsencrypt/certificates/DOMAIN.key /opt/bitnami/apache2/conf/server.key
sudo ln -sf /opt/bitnami/letsencrypt/certificates/DOMAIN.crt /opt/bitnami/apache2/conf/server.crt
sudo chown root:root /opt/bitnami/apache2/conf/server*
sudo chmod 600 /opt/bitnami/apache2/conf/server*

Web server – NGINX

sudo mv /opt/bitnami/nginx/conf/server.crt /opt/bitnami/nginx/conf/server.crt.old
sudo mv /opt/bitnami/nginx/conf/server.key /opt/bitnami/nginx/conf/server.key.old
sudo mv /opt/bitnami/nginx/conf/server.csr /opt/bitnami/nginx/conf/server.csr.old
sudo ln -sf /opt/bitnami/letsencrypt/certificates/DOMAIN.key /opt/bitnami/nginx/conf/server.key
sudo ln -sf /opt/bitnami/letsencrypt/certificates/DOMAIN.crt /opt/bitnami/nginx/conf/server.crt
sudo chown root:root /opt/bitnami/nginx/conf/server*
sudo chmod 600 /opt/bitnami/nginx/conf/server*

• Starting all Bitnami services

sudo /opt/bitnami/ctlscript.sh start

Step 4: Testing the entire configuration

Once you have completed all the previous steps, you can open your website in a browser using https to test it, e.g. https://DOMAIN (here too, replace the DOMAIN placeholder with your correct domain).

Firstly, your website should now be accessible, and secondly, there is now a padlock icon next to the address bar in your browser. Double-click on it to view all the details of the Let’s Encrypt certificate.

Step 5: Renewing the SSL certificate

A Let’s Encrypt certificate is only ever valid for 90 days, which is why it needs to be renewed regularly. To do this, log in to an AWS Lightsail instance again and run the following code to renew your certificate (you’ll need to replace both placeholders with your own values):

sudo /opt/bitnami/ctlscript.sh stop
sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADRESSE" --domains="DOMAIN" --domains="www.DOMAIN" --path="/opt/bitnami/letsencrypt" renew --days 90
sudo /opt/bitnami/ctlscript.sh start

Specifically, the second command on our website looks like this:

sudo /opt/bitnami/letsencrypt/lego --tls --email="info@goldenwebage.de" --domains="goldenwebage.de" --domains="www.goldenwebage.de" --path="/opt/bitnami/letsencrypt" renew --days 90

To avoid having to carry out this step manually every 90 days, you can also set up a cron job for this. The cron job ensures that the commands are executed automatically at regular intervals. Follow these steps to set up the cron job:

• Create a script that contains and then executes the commands

sudo nano /opt/bitnami/letsencrypt/scripts/renew-certificate.sh

• Paste the following content into the script (placeholders must be replaced with your own values)

#!/bin/bash

sudo /opt/bitnami/ctlscript.sh stop apache
sudo /opt/bitnami/letsencrypt/lego --tls --email="EMAIL-ADRESSE" --domains="DOMAIN" --domains="www.DOMAIN" --path="/opt/bitnami/letsencrypt" renew --days 90
sudo /opt/bitnami/ctlscript.sh start apache

• You then need to ensure that the script can be run by the system:

sudo chmod +x /opt/bitnami/letsencrypt/scripts/renew-certificate.sh

• Next, open the crontab editor so that you can set up the cron job:

sudo crontab -e

• Finally, add the following line to the file so that the system runs the script automatically on a regular basis:

0 0 1 * * /opt/bitnami/letsencrypt/scripts/renew-certificate.sh 2> /dev/null

With this article, you have now created your SSL certificate, configured it on your website and set up a cron job to ensure it is automatically renewed on a regular basis. To ensure your WordPress blog remains accessible via the secure https URL in future, there are two further tasks for you to complete:

• Switching your WordPress website to SSL in the admin panel
• Replacing your http links with https links in the WordPress database
• Redirect via the .htaccess file to your https://www.DOMAIN

We hope this article has been helpful and that your website is now accessible via an encrypted connection.

Golden regards,
Matthias and your team at Golden Web Age

Further links on this topic:
Lego documentary: https://github.com/go-acme/lego/blob/master/README.md
Bitnami documentation: https://docs.bitnami.com/aws/how-to/generate-install-lets-encrypt-ssl/
AWS documentation: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-using-lets-encrypt-certificates-with-wordpress
Let’s Encrypt documentation: https://letsencrypt.org/docs/