How to get an A Grade SSL Install with Letsencrypt on EC2

tom Tom, 26th May 2017

LetsEncrypt is great, but it doesn't always work brilliantly with Amazon EC2 instances.

Documented below are the various steps and hurdles I've had to overcome to install LetsEncrypt and configure Apache to run a clients site securely over SSL. I'm writing this as much as anything for my own reference as I keep having to remember this every time it comes up! I expect it'll soon be much easier than this, but for now, this is what you need to do.


> sudo yum install python27-devel
> sudo git clone /opt/letsencrypt
> sudo yum install python-pip
> sudo pip install virtualenv
> sudo ln -s /usr/local/bin/virtualenv /usr/bin/virtualenv
> sudo /opt/letsencrypt/letsencrypt-auto --debug

Allow SSL connections through your AWS security settings.

> sudo vi /etc/letsencrypt/config.ini

Add the following lines to this file:

rsa-key-size = 4096
email =

Then run the below to generate your certificate:

> sudo /opt/letsencrypt/letsencrypt-auto --debug --config /etc/letsencrypt/config.ini --agree-tos

This generated my certificate ok. However because of my older version of Apache (and other things I'd done to the httpd.conf and ssl.conf files), Letsencrypt couldn't automatically install it, which was annoying.

After an hour or so trying different things, I managed to manually install the certificate.

When making changes to your ssl.conf file you can avoid breaking your site by testing the config file first using the command:

> sudo service httpd configtest

Then once you get a 'Syntax OK' result do:

> sudo service httpd restart

Some of the configuration changes I made to the ssl.conf file are below, including disabling the RC4 cipher.

SSLCertificateFile /etc/letsencrypt/live/
SSLCertificateChainFile /etc/letsencrypt/live/
SSLCertificateKeyFile /etc/letsencrypt/live/



SSLHonorCipherOrder on

SSLProtocol -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2
SSLProxyProtocol -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +TLSv1.2

Expanding the certificate to cover new subdomains

Another issue we had to consider was installing the certificate on the various subdomains / domains that run via the default virtualhost. Thankfully no further ssl.conf updates are required for this and the new domains can neatly by added to the existing certificate with the following command:

> sudo /opt/letsencrypt/letsencrypt-auto --debug certonly -a standalone --expand --config /etc/letsencrypt/config.ini --agree-tos -d -d -d

The command above requires Apache to be stopped temporarily, so in an effort to streamline the process I created a little PHP script to do it for me.

All that remained then was to setup the cronjob to renew the certificate periodically:

0 5 * * * sudo /opt/letsencrypt/letsencrypt-auto renew --config /etc/letsencrypt/config.ini --agree-tos && sudo apachectl graceful


Want to share? Tweet it!

More from our blog

We are hiring: full stack developer

We are hiring: full stack developer


We're looking for an experienced PHP developer to join our highly effective team. We're problem solvers, with clients depending on us - some of them… Read →

OPC Markets Launch

OPC Markets Launch


We've been  busy helping our client with the launch of their new trading platform. Made in conjunction with FTSE 250 company owned, OPCMarkets… Read →

Video heros: the order of the day

Video heros: the order of the day


We recently had 3 clients - within the space of a few days - ask us for video heros on their home page. We do… Read →