HTTPS in AWS EC2 with certbot and letsencrypt, for free
Internet safety is moving into everyone’s mind. In some countries, being secured is, or will soon be, required by law. Technology wise I don’t see much of a change (although constantly being refined), but revolution is happening in the usage, application and integration of technology.
Hence, it has been on my mind to implement HTTPS. A stopping parameter has been that it seemed to cost a lot of money! With certbot and letsencrypt, that is not true.
This post contains some hints on how to enable https in AWS EC2 that I would have found very useful in my process:
Read and follow step 1 of the AWS tutorial: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/SSL-on-an-instance.html
Go to Letsencrypt and read the get started guid, https://letsencrypt.org/
You will be redirected to the https://certbot.eff.org/
Select your system and follow the instructions, should be noted that I used the Fedora22, meaning the below commands was applicable:
wget https://dl.eff.org/certbot-auto
Comment: This means there is no available package, so we need to download it.
I runned these commands from the usr/local/bin-location (don’t know if it matters)
Somewhere in this process, I encountered some error codes, saying not enough memory or similar. I was thinking about upgrading my EC2 image, but in order to do that, I had to stop it, and it seemed like a hassle. Instead, I added a swap-file.
To figure out my memory, the command free -m can be used.
To add the swap file, below command was what I used:
sudo /bin/dd if=/dev/zero of=/var/swap.1 bs=1M count=1024
sudo /sbin/mkswap /var/swap.1
sudo chmod 600 /var/swap.1
sudo /sbin/swapon /var/swap.1
Then I runned certbot-auto --apache --debug, and select the relevant options.
You should NOW automate the renewal of the certifications, as those expires after 90 days. Those two resources helped me:
http://stackoverflow.com/questions/10472173/cannot-get-cron-to-work-on-amazon-ec2
pointing out how to use the vim editor
pointing out that starting crontab is done with crond (don’t know if it was already running before, or if it had any impact)
https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/ explaining the logic of crontab
Still don’t know if I would have been better off to put the job in cron.d-folder. Now, I just added it with cron -e to the current user. When I added in separate file, it didn’t appear when running cron -l