How to get an A Grade SSL Install with Letsencrypt on EC2

tom Tom, 26th May 2017

LetsEncrypt is great, but it doesn't always work brilliantly with Amazon EC2 instances.

Documented below are the various steps and hurdles I've had to overcome to install LetsEncrypt and configure Apache to run a clients site securely over SSL. I'm writing this as much as anything for my own reference as I keep having to remember this every time it comes up! I expect it'll soon be much easier than this, but for now, this is what you need to do.


> sudo yum install python27-devel
> sudo git clone /opt/letsencrypt
> sudo yum install python-pip
> sudo pip install virtualenv
> sudo ln -s /usr/local/bin/virtualenv /usr/bin/virtualenv
> sudo /opt/letsencrypt/letsencrypt-auto --debug

Allow SSL connections through your AWS security settings.

> sudo vi /etc/letsencrypt/config.ini

Add the following lines to this file:

rsa-key-size = 4096
email =

Then run the below to generate your certificate:

> sudo /opt/letsencrypt/letsencrypt-auto --debug --config /etc/letsencrypt/config.ini --agree-tos

This generated my certificate ok. However because of my older version of Apache (and other things I'd done to the httpd.conf and ssl.conf files), Letsencrypt couldn't automatically install it, which was annoying.

After an hour or so trying different things, I managed to manually install the certificate.

When making changes to your ssl.conf file you can avoid breaking your site by testing the config file first using the command:

> sudo service httpd configtest

Then once you get a 'Syntax OK' result do:

> sudo service httpd restart

Some of the configuration changes I made to the ssl.conf file are below, including disabling the RC4 cipher.

SSLCertificateFile /etc/letsencrypt/live/
SSLCertificateChainFile /etc/letsencrypt/live/
SSLCertificateKeyFile /etc/letsencrypt/live/



SSLHonorCipherOrder on

SSLProtocol -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2
SSLProxyProtocol -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2

Expanding the certificate to cover new subdomains

Another issue we had to consider was installing the certificate on the various subdomains / domains that run via the default virtualhost. Thankfully no further ssl.conf updates are required for this and the new domains can neatly by added to the existing certificate with the following command:

> sudo /opt/letsencrypt/letsencrypt-auto --debug certonly -a standalone --expand --config /etc/letsencrypt/config.ini --agree-tos -d -d -d

The command above requires Apache to be stopped temporarily, so in an effort to streamline the process I created a little PHP script to do it for me.

All that remained then was to setup the cronjob to renew the certificate periodically:

0 5 * * * sudo /opt/letsencrypt/letsencrypt-auto renew --config /etc/letsencrypt/config.ini --agree-tos && sudo apachectl graceful


Want to share? Tweet it!

More from our blog

Why the Government needs coders: the devil is in the detail

Why the Government needs coders: the devil is in the detail


Our household is currently going around in circles as to whether we think the proposed return to school the week after next is a good idea.… Read →

Are NHSX being naive? And when will they delete our data?

Are NHSX being naive? And when will they delete our data?


Plans are being announced for the UK's contact tracing smarphone app, which will alert people when someone they've been near has started showing symptoms of COVID-19.… Read →

Food Home Delivery services now on

Food Home Delivery services now on

2.04.20 has been helping the world find event venues for almost 20 years. Initially solely about village halls, it now includes various community centres and conference venues.… Read →