Letsencrypt

Installation

1. SSH to test server

    ssh ec2-user@54.205.130.117

2. Download the certbot agent
   wget https://dl.eff.org/certbot-auto
3. Download prerequisite software for the first time

sudo rm -rf /opt/eff.org/certbot

sudo ./certbot-auto certonly --manual --debug

Generate SSL cert for one or multiple domains

1. Run certbot

sudo ./certbot-auto certonly --manual

2. Enter domain URLs. e.g. blog.cuveesfinewines.com
3. Copy the verification file to the connect web servers

sudo su

cd /home/jetty/webapps/connect/.well-known/acme-challenge/

4. Get the cert under /etc/letsencrypt/live/domain

sudo su

cd /etc/letsencrypt/live/domain

5. Upload the cert to AWS IAM
6. aws iam upload-server-certificate --server-certificate-name {certname} --certificate-body file://cert.pem --private-key file://privkey.pem --certificate-chain file://chain.pem

Use the SSL cert in AWS Elastic Load Balancer

Manual method:

    Go to EC2 -> Load Balancer -> Select the load balancer -> Listeners -> Add a protocol and use an uploaded IAM cert.

Make sure the port 443 is on for the security group associated with the load balancer.

Command line:

aws elb set-load-balancer-listener-ssl-certificate --load-balancer-name notey-connect-web --load-balancer-port 443 --ssl-certificate-id arn:aws:iam::610548120181:server-certificate/blog.cuvees.20171026

Renew Cert

sudo -H /opt/eff.org/certbot/venv/bin/letsencrypt certonly --standalone --renew-by-default -d blog.cuveesfinewines.com

Renew the cert automatically

1. Crontab -e
2. * * * * * /home/ec2-user/certbot-auto renew --quiet

Cert is in /etc/letsencrypt/live

https://www.linode.com/docs/security/ssl/install-lets-encrypt-to-create-ssl-certificates


aws iam list-server-certificates

aws iam delete-server-certificate  --server-certificate-name test.chinafy.com