The padlock shown next to a website's address means the connection is encrypted and the website is who it says it is. Without it, browsers warn of a "not secure site", Google ranks you lower and forms travel in the clear. Years ago a certificate cost money and paperwork; today Let's Encrypt gives them away for free and they renew on their own.
On a Lightsail machine there are two situations. If you created it from an application blueprint (WordPress, Joomla, LAMP...), it is a Bitnami image and comes with a tool that does everything with a few questions. If it is a "bare" Linux (Ubuntu, Debian, Amazon Linux) where you installed the web server yourself, you will use Certbot, which is also simple. The guide covers both.
Before you start: what each thing means
- HTTPS and certificate
- HTTPS is the secure version of HTTP, the way the browser talks to your website. To use it, the website needs a certificate: a file that proves the domain is yours and allows the connection to be encrypted.
- Let's Encrypt
- A non-profit organisation that issues certificates for free. They last 90 days and are renewed automatically by a program.
- Certbot
- The most widely used program for requesting and installing Let's Encrypt certificates on a Linux server.
- Bitnami
- The company that prepares the Lightsail application blueprints (WordPress, etc.). Its machines come with their own tool, bncert-tool, for the certificate.
- Apache and Nginx
- The two most common web servers: the program inside the machine that delivers the pages to the browser. The certificate is installed in it.
- Port 443
- The "door" through which HTTPS traffic comes in. The Lightsail firewall must have it open.
- SSH / browser terminal
- The way to give the machine orders by typing commands. In Lightsail you can open it with a button in the console, without installing anything.
- A record
- The DNS entry that makes your domain point to the machine's IP. Let's Encrypt checks it before issuing the certificate.
Step by step
Check the domain and the firewall
Two requirements without which nothing will work. First, the domain must already point to the machine's IP (and it should be a static IP): type the domain in the browser and it must load your website, even without a padlock. Second, in Lightsail, in the machine's Networking tab, the firewall must have HTTP (80) and HTTPS (443) open. 443 is not open by default: add it if it is missing.
Open the machine's terminal
In the Lightsail console, click the machine's Connect using SSH button (the orange terminal icon). A black window opens in the browser where you will type the commands of the following steps. There is no need to install any program on your computer.
If your machine is Bitnami: use its tool
Type:
sudo /opt/bitnami/bncert-toolIt will ask you for the domains (type
midominio.com www.midominio.com), whether you want to redirect HTTP to HTTPS (say yes) and whether you want www to redirect to the domain without www or the other way round (choose one). At the end it asks for an email for Let's Encrypt notices and for you to accept its terms. It restarts the services for you. When it finishes, the certificate is in place and renewal is scheduled. Go to step 5.If your machine is a plain Linux: use Certbot
On Ubuntu or Debian with Apache:
sudo apt update sudo apt install -y certbot python3-certbot-apache sudo certbot --apache -d midominio.com -d www.midominio.comWith Nginx, change
python3-certbot-apachetopython3-certbot-nginxand--apacheto--nginx. Certbot asks you for an email, to accept the terms and whether you want to redirect all traffic to HTTPS (say yes). It modifies the web server configuration itself and reloads it. On Amazon Linux the package names differ; the Certbot documentation has the exact instructions for each system.Check the padlock
Open
https://midominio.comin the browser: the padlock should appear and, when you click it, a certificate issued by Let's Encrypt (it appears as "R3", "R10" or another short name). Also try the version without https: it should redirect to the secure one on its own. If you use WordPress, check under Settings, General that both addresses start with https.Confirm that it will renew on its own
Let's Encrypt certificates expire after 90 days, but both bncert-tool and Certbot leave automatic renewal scheduled. For peace of mind, in the terminal:
sudo certbot renew --dry-run(On Bitnami, the equivalent is checking that the task exists in
sudo crontab -l.) If the dry run finishes without errors, you will not have to touch this again. Let's Encrypt will email you if renewal ever fails.
What can go wrong
It says it cannot verify the domain
Either the domain does not yet point to this machine (wait for DNS to propagate), or port 80 is closed in the Lightsail firewall. Let's Encrypt needs to reach your website on port 80 to check that it is yours.
There is a padlock but the browser warns of "mixed content"
The page loads images or scripts with http:// addresses. In WordPress, change the site addresses to https under Settings and, if needed, use a plugin that rewrites the old URLs. On a hand-made website, fix the links.
It works without www but not with www (or the other way round)
One of the two names is missing from the certificate or from the DNS. Repeat the command including both with -d, and check that www has its record in the DNS.
I have lost access after touching the firewall
The Lightsail firewall is fixed from the console, not from the machine. Go back to the Networking tab and review the rules. The browser terminal always works.
In Simplio
In Simplio you can launch the Let's Encrypt certificate installation on a Lightsail machine from the script catalogue, typing only the domain: Simplio logs in with the temporary key AWS provides, runs the steps and gives you back the result, leaving nothing installed. And it emails you if a certificate is about to expire without renewing.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| Install the certificate | Open port 443, terminal, bncert-tool or Certbot, answer questions: 5 steps, 20 minutes and a terminal | Let's Encrypt script from the catalogue: type the domain and click, 2 minutes |
| If renewal fails | Email from Let's Encrypt to whoever set it up, if they are still at the company | Email alert for a certificate about to expire |
| Several websites | Repeat on each machine | The same script on each machine, from the same list |