How to Secure AWS EC2 Ubuntu with Let’s Encrypt SSL (Certbot + Nginx)
Install Let's Encrypt SSL on AWS EC2 Ubuntu (with Certbot & Nginx)
Step-by-step guide to securing your AWS EC2 Ubuntu instance with a free Let's Encrypt TLS/SSL certificate using Certbot and Nginx, updated for modern Ubuntu.
Let's Encrypt provides free TLS/SSL certificates so your website can use HTTPS. On AWS EC2 with Ubuntu, the easiest way to get and renew these certificates is with Certbot. This guide shows you how to secure an Nginx site on Ubuntu using the modern, Snap-based Certbot installation, inspired by older tutorials but updated for today's tooling.
๐ What You'll Learn
- → Prerequisites for using Let's Encrypt on an AWS EC2 Ubuntu instance
- → How to install Certbot using Snap (recommended for Ubuntu)
- → How to issue and auto-configure an HTTPS certificate for Nginx
- → How automatic renewal works and how to test it
1. Prerequisites
- ✔ An AWS EC2 instance running Ubuntu (22.04 / 20.04 or similar)
- ✔ A registered domain name pointing to your EC2 public IP (via DNS A/AAAA record)
- ✔ Nginx installed and serving your site on HTTP (port 80)
- ✔ SSH access with
sudoprivileges
192.168.1.10). You must use a real domain (like example.com) that resolves to your
server.
2. Install Certbot on Ubuntu (Snap method)
Older guides used a Certbot PPA (e.g. ppa:certbot/certbot) and packages like python-certbot-nginx.
On modern Ubuntu releases, the official recommendation is to use Snap instead. We'll start with the
modern Snap approach and then, in the next section, briefly cover the legacy PPA method for older Ubuntu versions.
2.1 Update packages and install Snap
sudo apt update
sudo apt install snapd -y2.2 Install and refresh Snap core
sudo snap install core
sudo snap refresh core2.3 Install Certbot
sudo snap install --classic certbot
Create a convenient symlink so you can run certbot directly:
sudo ln -s /snap/bin/certbot /usr/bin/certbot3. Legacy PPA-based Certbot install (older Ubuntu)
If you're running an older Ubuntu release (for example, 16.04 or 18.04) and can't use Snap, you may still find
guides that use the ppa:certbot/certbot repository. This method is deprecated but helpful
to understand if you maintain legacy servers.
3.1 Add Certbot PPA and dependencies
First, connect to your EC2 Ubuntu instance via SSH, then run:
sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get updateThis installs the tools needed for managing PPAs, adds the Certbot repository, and refreshes your package index.
3.2 Install Certbot plugins for Apache or Nginx
Choose the package that matches your web server:
# For Apache
sudo apt-get install python-certbot-apache
# For Nginx
sudo apt-get install python-certbot-nginxThese packages install Certbot plus the appropriate plugin to automatically edit your Apache/Nginx configuration.
3.3 Issue certificates (Apache or Nginx)
Once Certbot is installed, you can request certificates for one or more domains. The first domain is treated as the primary name, additional ones are aliases:
# Apache example
sudo certbot --apache -d yourdomain.com -d www.yourdomain.com
# Nginx example
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
Certbot will store your certificate and private key under
/etc/letsencrypt/live/yourdomain.com/ and automatically update your virtual host / server block
configuration in /etc/apache2/sites-available/ or /etc/nginx/sites-available/.
4. Obtain a Let's Encrypt SSL certificate for Nginx
Make sure Nginx is serving your site on port 80 and the domain points to this server. Then run Certbot's Nginx plugin, which will obtain a certificate and update your Nginx configuration automatically.
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com- Replace
yourdomain.comandwww.yourdomain.comwith your real domain(s). - Certbot will ask for an email address and terms of service agreement.
- You can choose whether to redirect all HTTP traffic to HTTPS (recommended).
5. Test automatic renewal
Let's Encrypt certificates are valid for 90 days. Certbot installs a systemd timer to renew them automatically. You can simulate a renewal to confirm everything is wired correctly:
sudo certbot renew --dry-runIf you see no errors, your certificates will renew automatically before they expire.
6. Common issues & fixes
E: Unable to locate package python-certbot-nginx
This usually means you're following an old PPA-based guide. Remove the PPA and use the Snap method shown above instead.
Challenge failed / HTTP-01 validation errors
Ensure port 80 is open in your AWS security group and that your domain's DNS A/AAAA record points to this EC2
instance. Certbot must be able to reach http://yourdomain.com/.well-known/ during validation.
7. Summary
With Certbot and Let's Encrypt, you can secure your AWS EC2 Ubuntu instance with HTTPS in just a few commands. Compared to older PPA-based approaches, the Snap method is more reliable on modern Ubuntu versions and keeps Certbot up to date automatically.
