--- title: SSL Encryption using Let’s Encrypt on AWS EC2 Amazon Linux description: We need our websites to be secured and for securing our websites, we need to enable HTTPS by getting a SSL Certificate from certificate authority. Let’s Encrypt is a Certificate Authority which offers free SSL Certificates which is as secured as the present paid certificates. --- [![e-Zest logo_An accion lab company_Colour](https://blog.e-zest.com/hubfs/images/Logos%20with%20Tagline/Corporate/SVG/e-Zest%20logo_An%20accion%20lab%20company_Colour.svg "e-Zest logo_An accion lab company_Colour")](https://www.e-zest.com/) - [WORK](https://www.e-zest.com/our-work) - [SERVICES](https://www.e-zest.com/our-services) - [Product Engineering](https://www.e-zest.com/digital-product-engineering-services) - [Enterprise Data Services](https://www.e-zest.com/enterprise-data-services) - [Digital Commerce](https://www.e-zest.com/digital-commerce-services) - [Digital Operations](https://www.e-zest.com/digital-operations) - [Digital Consulting](https://www.e-zest.com/digital-transformation-consulting-services) - [Digital Experience Design](https://www.e-zest.com/digital-experience-design) - [INSIGHTS](https://blog.e-zest.com/) - [CAREERS](https://www.e-zest.com/careers) - [ENTERPRISE DATA SERVICES](https://www.e-zest.com/enterprise-data-services) - [GENERATIVE AI](https://www.e-zest.com/generative-ai) - [Healthcare](https://healthcare.e-zest.com) - [Contact Us](https://www.e-zest.com/contact-us) - ![Elevating Product Engineering with AI and ML](https://blog.e-zest.com/hubfs/Elevating%20Product%20Engineering%20with%20AI%20and%20ML.jpg) [BLOGS](https://blog.e-zest.com) #### Elevating Product Engineering with AI and ML As technology evolves and customer choices broaden, there is an increasing ... [Read more](https://blog.e-zest.com/elevating-product-engineering-with-ai-and-ml) - ![e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024](https://blog.e-zest.com/hubfs/e-Zest%20%E2%80%93%20An%20Accion%20Labs%20Company%20-%20Gets%20Recognition%20as%20a%20Contender%20in%20the%20ISG%20Provider%20LensTM%20Study%20on%20Digital%20Engineering%20Services%202024.jpg) [NEWS](https://blog.e-zest.com/news) #### e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024 We are delighted to announce that e-Zest – An Accion Labs Company has been ... [Read more](https://blog.e-zest.com/news/e-zest-an-accion-labs-company-gets-recognition-as-a-contender-in-the-isg-provider-lens-study-on-digital-engineering-services-2024) - ![e-Zest Solutions supports Digital Pune Mission](https://blog.e-zest.com/hubfs/blog-files/Digital%20Literacy%20Bus%20e-Zest.png) [CSR](https://blog.e-zest.com/csr) #### e-Zest Solutions supports Digital Pune Mission **Pune, India:** e-Zest Solutions, a leading digital technology innovation ... [Read more](https://blog.e-zest.com/csr/e-zest-solutions-supports-digital-pune-mission) - [Work](https://www.e-zest.com/our-work) - [Services](https://www.e-zest.com/our-services) - [Insights](https://blog.e-zest.com) - [Careers](https://www.e-zest.com/careers) - [Enterprise Data](https://www.e-zest.com/enterprise-data-services) - [Generative AI](https://www.e-zest.com/generative-ai) - [Innovations](https://www.e-zest.com/innovations) - [Healthcare](https://healthcare.e-zest.com) - [About](https://www.e-zest.com/about-us) - [Contact](https://www.e-zest.com/contact-us) - [Blog](https://blog.e-zest.com/) - [News](https://blog.e-zest.com/news) - [CSR](https://blog.e-zest.com/csr) - [![Linkedin Icon](https://blog.e-zest.com/hubfs/icons/linkedin_icon_white.svg)](https://www.linkedin.com/company/e-zest-solutions/) - [![Twitter Icon](https://blog.e-zest.com/hubfs/twitter-logo-silhouette%20(5).svg)](https://twitter.com/ezest) - [![Facebook Icon](https://blog.e-zest.com/hubfs/facebook-app-logo%20(4).svg)](https://www.facebook.com/61259256638) - [![Instagram Icon](https://blog.e-zest.com/hubfs/instagram-logo%20(4).svg)](https://www.instagram.com/ezestsolutions/) - [![Youtube Icon](https://blog.e-zest.com/hubfs/icons/youtube_icon_white.svg)](https://www.youtube.com/user/ezestcorporate) [![Go to top icon](https://blog.e-zest.com/hubfs/AA%20Assets/top%20button.svg)](https://blog.e-zest.com/ssl-encryption-using-lets-encrypt-on-aws-ec2-amazon-linux#top) Hit enter to search or ESC to close Insights e-Zest members share technology ideas to foster digital transformation. - [Blog](https://blog.e-zest.com) - [News](https://blog.e-zest.com/news) - [Podcasts](https://www.e-zest.com/podcasts) - [Healthcare](https://blog.e-zest.com/healthcare) - [CSR](https://blog.e-zest.com/csr) - [Whitepaper](https://blog.e-zest.com/whitepaper) - [Playbook](https://blog.e-zest.com/playbook) - [Media Kit](https://www.e-zest.com/media-kit) # SSL Encryption using Let’s Encrypt on AWS EC2 Amazon Linux [Anagha Thorat](https://blog.e-zest.com/author/anagha-thorat) Feb 27, 2017 [AWS](https://blog.e-zest.com/topic/aws) [Amazon Linux](https://blog.e-zest.com/topic/amazon-linux) [SSL](https://blog.e-zest.com/topic/ssl) [SSL encryption](https://blog.e-zest.com/topic/ssl-encryption) [AWS EC2 Amazon Linux](https://blog.e-zest.com/topic/aws-ec2-amazon-linux) - - - - **What is Let’s Encrypt:** We need our websites to be secured and for securing our websites, we need to enable HTTPS by getting a SSL Certificate from certificate authority. Let’s Encrypt is a Certificate Authority which offers free SSL Certificates which is as secured as the present paid certificates. **Benefits:** - Free: It is open-source and free of cost for life time. - Automatic: It can be set for auto renewal through cron jobs. Each certificate is valid for 90days. - Simple: It has a very simple script. - Secured: It is as secured as the present paid certificates. **Points to be covered:** - Let’s Encrypt with Apache - Let’s Encrypt with Tomcat **Let’s Encrypt with Apache** Basic requirement: To issue a certificate through Let’s Encrypt you should have control over the domain associated with server. We need git installed on server. Install git with following command: yum install git **Installation** - Install Let’s Encrypt Online: Use the following command curl https://get.acme.sh |sh OR wget -O - https://get.acme.sh |sh - Install Let’s Encrypt from GIT Use the following command git clone https://github.com/Neilpang/acme.sh.git cd ./acme.sh ./acme.sh --install **Issue a Certificate for Apache/Tomacat** **Single Domain** acme.sh --issue -d abc.com -w /home/root/abc.com **Multiple Domains in same cert** acme.sh --issue -d abc.com -d www.abc.com -d cp.abc.com –w /home/root/abc.com **Note:** 1. The parameter /home/root/abc.com is the web root folder. You should have write access to this folder. 2. abc.comis the main domain. You must have at least one domain. 3. Bind all the domains to the same web root directory : /home/root/abc.com 4. Generated/issued certs will be placed in ~/.acme.sh/abc.com/ **Install the issued Certificate on Apache** After issuing the certificate you must install the certificate or copy it to a particular path. Please note: Do not use the certificates in ~/.acme.sh/folder. Best practice is to copy the certificates files and provide that path. To install the certificate use the following command acme.sh --installcert -d example.com \\ --certpath /path/to/certfile/in/apache/cert.pem \\ --keypath /path/to/keyfile/in/apache/key.pem \\ --fullchainpath /path/to/fullchain/certfile/apache/fullchain.pem \\ --reloadcmd "service apache2 force-reload" Open ssl.conf file and add the path to the file vim /etc/httpd/conf.d/ssl.conf SSLCertificateFile path/to/certfile/in/apache/cert.cer SSLCertificateKeyFile path/to/keyfile/in/apache/key.pem SSLCertificateChainFile /path/to/fullchain/certfile/apache/fullchain.pem SSLCACertificateFile path/to/certfile/in/apache/ca.cer Reload apache server servicehttpd reload **Let’s Encrypt with Tomcat** For running Tomcat7 to run on HTTPS we need to provide it with certificate and entire chain certificate. The connection is supposed to be private and we need a private, corresponding to the certificate to decrypt the client generated random key. This client generated random key is encrypted with the server’s public key (which is part of the certificate) by the client, so it can be safely transmitted to your server. We will do is to put the chain certificate and the private key all together inside one Java Key Store (JKS). There are only two steps required to get our fullchain.pem and privkey.pem inside a JKS. Enter the following command: $ openssl pkcs12 -export -in fullchain.pem -inkeyprivkey.pem -out fullchain\_and\_key.p12 -name tomcat You will be asked to enter a password after the above command. Please remember the password as it is because will be need it in the next step. Now we have our keystore, we can use JAVA’s keytool to generate a JKS. Use the below command $ keytool -importkeystore -deststorepassyourJKSpass -destkeypassyourKeyPass –destkeystoreKeyStore.jks -srckeystore fullchain\_and\_key.p12 -srcstoretype PKCS12 -srcstorepass yourPKCS12pass -alias tomcat Configure Tomcat for HTTPS Open the server.xml file vim /etc/tomcat7/server.xml Find the block starting with Restart your tomcat service tomcat7 restart **Check your site** You can check your site by hitting [https://yourdomain:443](https://yourdomain:443) - - - ### Similar Blog [![AWS IoT - Now Migration is Quick and Easy](https://blog.e-zest.com/hubfs/Blog%20Graphic%20(AWS%20IoT%20migration)%20V5-05.jpg) AWS IoT - Now Migration is Quick and Easy AWS can help make your migration quick and easy Modern businesses employ Internet of Things (IoT) platforms to manage their ... By Mohini Wable Nov 22, 2022](https://blog.e-zest.com/aws-iot-now-migration-is-quick-and-easy) [![3 Cloud-Native Trends That are Reshaping Our Businesses in 2022](https://blog.e-zest.com/hubfs/e-Newsletter-04.jpg) 3 Cloud-Native Trends That are Reshaping Our Businesses in 2022 The move to the cloud was a trend that was already making headways before the pandemic-led digital shift. But post-2020, the ... By Devendra Deshmukh Feb 22, 2022](https://blog.e-zest.com/3-cloud-native-trends-that-are-reshaping-our-businesses-in-2022) [![AWS EC2 Assume Role with Terraform](https://blog.e-zest.com/hubfs/blog-files/AWS%20EC2%20Assume%20Role%20with%20Terraform.jpg) AWS EC2 Assume Role with Terraform Nowadays, it is an ideal practice to keep different AWS accounts for IAM users and a different account for running production ... By Vaibhav Khalane Jan 28, 2020](https://blog.e-zest.com/aws-ec2-assume-role-with-terraform) [![How to enable SMS alerts in Nagios using AWS SNS](https://blog.e-zest.com/hubfs/blog-files/nagios.png) How to enable SMS alerts in Nagios using AWS SNS Nagios is a powerful management and monitoring system. It helps in identifying the IT infrastructure problems. It also helps in ... By Anagha Thorat Feb 06, 2019](https://blog.e-zest.com/how-to-enable-sms-alerts-in-nagios-using-aws-sns) [Service cloud Einstein to integrate with Amazon Connect Previously, enterprises were highly dependent on paper documentations. Later a huge computer revolution encountered, which ... By Nidhi Thakkar Apr 17, 2017](https://blog.e-zest.com/service-cloud-einstein-to-integrate-with-amazon-connect) [![How to enable SMS alerts in Nagios using AWS SNS](https://blog.e-zest.com/hubfs/blog-files/nagios.png) How to enable SMS alerts in Nagios using AWS SNS Nagios is a powerful management and monitoring system. It helps in identifying the IT infrastructure problems. It also helps in ... By Anagha Thorat Feb 06, 2019](https://blog.e-zest.com/how-to-enable-sms-alerts-in-nagios-using-aws-sns) [![Installing and setting HDFS cluster through Ambari](https://blog.e-zest.com/hubfs/blog-files/Installing%20and%20setting%20HDFS%20cluster%20through%20Ambari-181205.png) Installing and setting HDFS cluster through Ambari Apache Ambari is an open source management tool/platform for managing, provisioning, securing and monitoring the Hadoop Cluster. ... By Anagha Thorat Oct 31, 2018](https://blog.e-zest.com/installing-and-setting-hdfs-cluster-through-ambari) [Troubleshooting with Nginx - **Introduction** What is Nginx? By Anagha Thorat Nov 22, 2016](https://blog.e-zest.com/troubleshooting-with-nginx) ## Helping Organizations Thrive in the Digital Age [Contact Us](https://www.e-zest.com/contact-us) - [About](https://www.e-zest.com/about-us) - [Services](https://www.e-zest.com/our-services) - [Work](https://www.e-zest.com/our-work) - [Insights](https://blog.e-zest.com/) - [Healthcare](https://healthcare.e-zest.com/) - [Accion Labs](https://www.accionlabs.com/) - - - - - - Dallas - Detroit - Hannover - Vienna - London - Pune © 2025 e-Zest Solutions - [Privacy Policy](https://www.e-zest.com/privacypolicy) - [Cookie Policy](https://www.e-zest.com/cookie-policy) Contact us Contact us e-Zest is a leading digital innovation partner for enterprises and technology companies that utilizes emerging technologies for creating engaging customers experiences. Being a customer-focused and technology-driven company, it always helps clients in crafting holistic business value for their software development efforts. It offers software development and consulting services for cloud computing, enterprise mobility, big data and analytics, user experience and digital commerce. ![](https://dc.ads.linkedin.com/collect/?pid=322361&fmt=gif)