Editing Elastic Beanstalk Security Certificates Archived November 2020 (section)

=== Installing LE Certificates with nginx ===

The following instructions originate from [https://piratefache.ch/lets-encrypt-with-amazon-elastic-beanstalk/ Let's Encrypt with AWS Elastic Beanstalk] by “PirateFaché”. This installs LE certificates on nginx.

<p class="alert alert-warning">The following directives in the .ebextensions file will ''NOT'' change the configuration of the nginx server. See [[#Cannot_create_files_in_.2Fetc.2Fnginx.2Fconf.d_with_.ebextensions|Troubleshooting]] for details.</p>

Creating `/etc/nginx/conf.d/https_custom.conf` allows requests to port 443 to access the LE certificates

<syntaxhighlight lang="yaml">
# HTTPS server
server {
    listen       443 default ssl;
    server_name  localhost;
    error_page  497 https://$host$request_uri;

    ssl_certificate      /etc/letsencrypt/live/ebcert/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/ebcert/privkey.pem;

    ssl_session_timeout  5m;
    ssl_protocols  TLSv1.1 TLSv1.2;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_prefer_server_ciphers   on;

    # Include the Elastic Beanstalk generated locations
    include conf.d/elasticbeanstalk/*.conf;
}
</syntaxhighlight>

It’s necessary to create a symbolic link from the “ebcert” directory specified in the file above with the actual directory containing the LE certificates:

<pre>
$ sudo ln -sf /etc/letsencrypt/live/wiki.dbarchowsky.com /etc/letsencrypt/live/ebcert
</pre>

Restart nginx

<pre>
$ sudo systemctl restart nginx
</pre>

At this point it should be possible to make https requests to the site:

<pre>
$ curl https://mydomain.com
</pre>