Ravindra BagaleCourses & study guides

Guides

How to Install a Free SSL Certificate on EC2 (Let's Encrypt + Certbot)

By , AWS & DevOps trainer LinkedIn Published: Last updated:

To install a free SSL certificate on AWS EC2, point your domain's A record to the instance's Elastic IP, open ports 80 and 443 in the security group, install Certbot (sudo yum install -y certbot python3-certbot-nginx on Amazon Linux 2023) and run sudo certbot --nginx -d example.com -d www.example.com --redirect. Certbot gets a Let's Encrypt certificate, configures Nginx for HTTPS and sets up renewal. Let's Encrypt does not issue certificates for a bare IP address, so you need a domain.

Friends, the domain is set up and the website works – but the browser says "Not secure". And if you want to send her the link, you need a proper domain and a 🔒! In this guide we install a free Let's Encrypt certificate with Certbot. One command, but three things must be ready before it – the domain, ports 80/443 and server_name. Every site with a login or contact form needs HTTPS, because visitors type a password or mobile number there.

Quick answer

On Amazon Linux 2023 with Nginx, once example.com points to your Elastic IP and ports 80/443 are open:

sudo yum install -y certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com --redirect
curl -I https://example.com          # expect HTTP/1.1 200 OK
sudo certbot renew --dry-run         # test automatic renewal

For Apache: sudo yum install -y python3-certbot-apache mod_ssl and sudo certbot --apache -d example.com -d www.example.com.

What do I need before installing an SSL certificate?

  1. A domain whose A record points to your Elastic IP — see How to Connect a GoDaddy Domain to AWS EC2. Check: dig example.com +short shows your Elastic IP.
  2. Ports 80 and 443 open to 0.0.0.0/0 — see How to Open Port 80 and 443 in an EC2 Security Group. Let's Encrypt checks your domain over port 80.
  3. A web server that already answers for the domain: server_name example.com www.example.com; in Nginx (see How to Host a Static Website on EC2 with Nginx), or ServerName/ServerAlias in Apache. curl -I http://example.com returns 200.

How does HTTPS work?

How HTTPS and the padlock work The browser says hello to the server on port 443. The server sends its Let's Encrypt certificate for example.com. The browser checks the certificate, the padlock closes, and after that all data travels encrypted in both directions. port 443 → https://example.com Browser certificate valid EC2 + Nginx Let's Encrypt certificate by certbot After the check, requests and responses travel encrypted. Hello cert: example.com encrypted encrypted

The browser says hello on port 443, the server sends its Let's Encrypt certificate, the browser checks it and shows the padlock. After that, all data travels encrypted.

HTTPS is HTTP inside TLS encryption. The server proves its identity with a certificate signed by a trusted certificate authority — here Let's Encrypt, which is free. Certbot is the tool that asks Let's Encrypt for the certificate, proves that you control the domain, installs the certificate into Nginx or Apache and renews it before it expires.

How do I install a free Let's Encrypt certificate with Certbot?

Step 1 — Check DNS and the web server first

dig example.com +short               # must print your Elastic IP
dig www.example.com +short           # must end with your Elastic IP
curl -I http://example.com           # must return 200 from your server

Certbot verifies each name with an HTTP request, so every -d name must already resolve to this server.

Step 2 — Install Certbot

# Amazon Linux 2023 + Nginx
sudo yum install -y certbot python3-certbot-nginx
# Amazon Linux 2023 + Apache (the Apache plugin needs mod_ssl)
sudo yum install -y certbot python3-certbot-apache mod_ssl

If the certbot package is not found on your Amazon Linux 2023 image, install it in a Python virtual environment instead:

sudo python3 -m venv /opt/certbot
sudo /opt/certbot/bin/pip install certbot certbot-nginx        # certbot-apache for Apache
sudo ln -s /opt/certbot/bin/certbot /usr/bin/certbot

On Ubuntu: sudo apt install -y certbot python3-certbot-nginx. On CentOS Stream 9, Certbot comes from EPEL (sudo yum install -y epel-release first).

Step 3 — Get the certificate and turn on HTTPS

sudo certbot --nginx -d example.com -d www.example.com --redirect

Certbot asks for an email address (for expiry warnings) and for agreement to the terms, then edits your server block: it adds listen 443 ssl, the certificate paths under /etc/letsencrypt/live/example.com/, and with --redirect a 301 from HTTP to HTTPS. For Apache use sudo certbot --apache -d example.com -d www.example.com.

Step 4 — Test HTTPS

curl -I http://example.com           # expect 301 Moved Permanently → https://
curl -I https://example.com          # expect HTTP/1.1 200 OK
sudo certbot certificates            # names, paths and expiry date

Open https://example.com in the browser: the padlock is there. Send the link!

Ravindra Bagale's Tip

Many students run certbot before the domain's A record points to the Elastic IP or before port 80 is open; validation fails, they try again and again – and hit Let's Encrypt's rate limits. First dig +short, then the security group, then certbot once. If you just want to test, there is --dry-run.

How do I make sure the certificate renews automatically?

Let's Encrypt certificates are short-lived, so renewal must work without you. Test it:

sudo certbot renew --dry-run                 # must end with "Congratulations, all simulated renewals succeeded"
systemctl list-unit-files | grep -i certbot  # is a certbot renewal timer installed?
  • If the list shows certbot-renew.timer, make sure it is enabled: sudo systemctl enable --now certbot-renew.timer.
  • If nothing is listed (for example after the virtual-environment install), add the renewal job from the official Certbot instructions. Amazon Linux 2023 has no cron daemon by default, so install it first:
sudo yum install -y cronie && sudo systemctl enable --now crond
echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" | sudo tee -a /etc/crontab > /dev/null

Ravindra Bagale's Tip

💡 Don't think the job is over once the certificate is installed. Run sudo certbot renew --dry-run today and write the expiry date from sudo certbot certificates in your calendar. If renewal fails, one day your visitors will suddenly see a scary "Not secure" warning. Stay alert!

How do I fix common Certbot errors?

Ghabru naka 😅 — the message tells you where to look:

Symptom Likely cause Fix
Timeout during connect (likely firewall problem) Port 80 closed, or DNS points elsewhere Allow HTTP 80; dig example.​com +short must show your EIP
DNS problem: NXDOMAIN looking up A for ... The name has no A record yet Add the record (e.g. CNAME www), wait for TTL, retry
Could not automatically find a matching server block No server_​name example.​com in Nginx Add both names to server_name, sudo nginx -t, reload
too many failed authorizations recently Rate limit after repeated failures Fix DNS/port first; test with --dry-run; wait before retrying
https:// refuses to connect Port 443 closed in the security group Allow HTTPS 443 from 0.0.0.0/0
Browser warns about the certificate Visiting a name not on the certificate, or the bare IP Use a name you passed with -d; add it with --expand
Apache: plugin fails to load SSL mod_ssl not installed sudo yum install -​y mod_​ssl, sudo service httpd restart

Learn it properly

This guide is the short path. The free AWS course explains every step in depth, with labs:

Got it? First DNS, then ports 80/443, then server_name, and finally a single certbot command – that's the order. Don't forget the renewal --dry-run. Your site is secure now – send the link with confidence.

Frequently asked questions

How do I install a free SSL certificate on EC2?

Point your domain to the Elastic IP, open ports 80 and 443, install Certbot (sudo yum install -y certbot python3-certbot-nginx on Amazon Linux 2023) and run sudo certbot --nginx -d example.com -d www.example.com.

Can I get a Let's Encrypt certificate for an EC2 public IP?

No. Let's Encrypt issues certificates for domain names, not for a bare IP. You need a domain whose A record points to your Elastic IP.

Why does Certbot fail with "Timeout during connect"?

Let's Encrypt could not reach your server on port 80 for the domain. Check dig example.com +short (it must show your Elastic IP) and allow HTTP 80 in the security group, then run certbot once more.

Does the certificate renew automatically?

Certbot sets up renewal. Test it with sudo certbot renew --dry-run and list expiry dates with sudo certbot certificates. Certificates are short-lived, so renewal must work.

How do I redirect HTTP to HTTPS?

Add --redirect to the certbot command, or choose the redirect option when certbot asks. Then curl -I http://example.com returns a 301 to https://.

How do I use Certbot with Apache instead of Nginx?

Install python3-certbot-apache and mod_ssl, and run sudo certbot --apache -d example.com -d www.example.com. Everything else is the same.