How to install an SSL/TLS certificate on Amazon EC2 (AWS)
The instructions below walk you through installing SSL on an Amazon EC2 (AWS) server. If you have more than one server or device, you will need to install the certificate on each one you want to protect. If you have not generated your certificate or finished validation yet, see our Amazon EC2 CSR generation instructions before following the steps below.
What you need
1. Your server certificate
This is the certificate the certificate authority issued for your domain. It may have been emailed to you. If not, you can download it from your account dashboard by clicking on your order.
2. Your intermediate certificates
These files let devices connecting to your server identify the issuing certificate authority. There may be more than one of them. If your certificate arrived in a ZIP folder, the intermediates — sometimes called the CA bundle — should be in there too. If not, download the right CA bundle for your certificate.
3. Your private key
This file should be on your server, or in your hands if you generated your CSR with a free generator tool.
1. Connect to your EC2 instance
For how to connect to your instance, see Amazon's guide here.
2. Save the certificates to the EC2 certificate directory
Go to the /etc/pki/tls/certs directory and save the server certificate and the intermediate CA certificate files there.
The simplest way to get the certificate into the directory is to open each one in a text editor, such as Notepad, on your local machine. Then open a text editor on your EC2 instance and copy the contents of each certificate across. This needs root [sudo] permissions.
3. Check the file permissions
Use the following commands to confirm that the server certificate file's owner, group and permissions match the Amazon Linux 2 defaults — owner root, group root, read/write for the owner only.
[ec2-user certs]$ sudo chown root:root custom.crt
[ec2-user certs]$ sudo chmod 600 custom.crt
[ec2-user certs]$ ls -al custom.crt
Those commands should produce:
-rw------- root root custom.crt
You should also check the permissions on the intermediate certificate file, which are less strict. Run:
[ec2-user certs]$ sudo chown root:root intermediate.crt
[ec2-user certs]$ sudo chmod 644 intermediate.crt
[ec2-user certs]$ ls -al intermediate.crt
Those commands should produce:
-rw-r--r-- root root intermediate.crt
4. Put the private key in the private key directory
Go to your private key directory at /etc/pki/tls/private/.
If the key is not saved there yet, follow the same steps you used for the certificate files to get the private key into this directory. You may need to copy and paste the key's contents between a text editor on your local machine and one open on EC2.
Again, check the file permissions on the private key:
[ec2-user private]$ sudo chown root:root custom.key
[ec2-user private]$ sudo chmod 600 custom.key
[ec2-user private]$ ls -al custom.key
Those commands should produce:
-rw------- root root custom.key
5. Edit the configuration file
Your certificate's configuration file should be at /etc/httpd/conf.d/ssl.conf.
- Give the path and filename of the server certificate — called custom.crt in this example — in Apache's
SSLCertificateFiledirective:
SSLCertificateFile /etc/pki/tls/certs/custom.crt
- Give the path and filename of the intermediate CA certificate — called intermediate.crt in this example — in Apache's
SSLCACertificateFile directive:
SSLCACertificateFile /etc/pki/tls/certs/intermediate.crt
- Give the path and filename of the private key — called custom.key in this example — in Apache's
SSLCertificateKeyFiledirective:
SSLCertificateKeyFile /etc/pki/tls/private/custom.key
-
Save the configuration file at
/etc/httpd/conf.d/ssl.conf. -
Restart Apache with:
[ec2-user ~]$ sudo systemctl restart httpd
- Test the installation by visiting your domain with the HTTPS:// prefix. If SSL installed correctly, the page should load securely over HTTPS and show the usual padlock.
That is it — your SSL certificate is installed. To check your work, open the site in your browser at https://yourdomain.tld and look at the certificate and site information to confirm HTTPS is working properly. Remember that you may need to restart your server before the changes take effect.
To check your installation properly, use our SSL Checker. If something does not add up, get in touch and we will look at it with you.
