How to Set Up SSL on an AWS EC2 Instance Using Apache and Let’s Encrypt (Certbot)

Free HTTPS for your Apache-hosted application in less than 10 minutes.

When deploying applications on AWS EC2, securing your website with HTTPS is one of the most important final steps before going live. Whether you’re hosting a PHP application, a WordPress website, or even using Apache as a reverse proxy for Node.js or Python applications, enabling SSL ensures that all communication between your users and your server is encrypted.

Fortunately, Let’s Encrypt provides free SSL certificates, and Certbot automates the entire installation process.

In this guide, we’ll walk through the exact steps to configure HTTPS on an Ubuntu EC2 instance running Apache.

1. Prerequisites

Before configuring SSL, make sure you have the following:

• An AWS EC2 instance running Ubuntu 20.04 or later
• A registered domain name
• Your domain’s A record pointing to your EC2 Public IPv4 address
• Apache installed and running
• Security Group allowing:
• TCP 80 (HTTP)
• TCP 443 (HTTPS)

Install Apache

Update the package repository.

sudo apt update

Install Apache.

sudo apt install apache2 -y

Enable Apache.

sudo systemctl enable apache2
sudo systemctl start apache2

Verify its status.

sudo systemctl status apache2

Visit your EC2 public IP.

http://<EC2-Public-IP>

You should see the default Apache page.

Verify DNS

Ensure your domain points to your EC2 instance.

Using ping:

ping yourdomain.com

Or:

curl -I http://yourdomain.com

Once your domain resolves correctly, you’re ready to install SSL.

2. What is Certbot?

Certbot is an open-source client developed by the Electronic Frontier Foundation (EFF) that automates obtaining and installing SSL certificates from Let’s Encrypt.

Instead of manually generating certificates, Certbot automatically:

• Requests a free SSL certificate
• Configures Apache
• Enables HTTPS
• Optionally redirects HTTP to HTTPS
• Configures automatic renewal

Install Certbot

Update packages.

sudo apt update

Install Certbot with the Apache plugin.

sudo apt install certbot python3-certbot-apache -y

The python3-certbot-apache package allows Certbot to automatically detect and update Apache VirtualHost configurations.

3. Generate Your SSL Certificate

Run:

sudo certbot --apache

Certbot will ask several questions.

Email Address: Provide an email address for renewal notifications.

Accept the Terms: Accept the Let’s Encrypt Terms of Service.

EFF Email List (Optional): Choose No if you don’t want promotional emails.

Select Your Domain (Certbot scans Apache configuration files and lists all available domains): Choose the domain(s) you want to secure.

Redirect HTTP to HTTPS (Choose): “Redirect”

Certbot will automatically configure permanent HTTP → HTTPS redirection.

Successful Installation

If everything succeeds, you’ll see something similar to:

Congratulations!

Your certificate and chain have been saved at:

/etc/letsencrypt/live/yourdomain.com/fullchain.pem

Your key file has been saved at:

/etc/letsencrypt/live/yourdomain.com/privkey.pem

Visit:

https://yourdomain.com

The browser should display the secure padlock icon.

Verify using:

curl -I https://yourdomain.com

Expected response:

HTTP/2 200

or:

HTTP/1.1 301 Moved Permanently
Location: https://yourdomain.com/  

4. Understanding the Apache Configuration

Unlike Nginx, Apache stores website configurations inside VirtualHost files.

Typical locations are:

/etc/apache2/sites-available/000-default.conf

or:

/etc/apache2/sites-available/yourdomain.conf

Open the configuration.

sudo nano /etc/apache2/sites-available/yourdomain.conf

HTTP VirtualHost:

<VirtualHost *:80>

    ServerName yourdomain.com
    ServerAlias www.yourdomain.com

    Redirect permanent / https://yourdomain.com/

</VirtualHost>

This redirects all HTTP traffic to HTTPS.

HTTPS VirtualHost:

<VirtualHost *:443>

    ServerName yourdomain.com
    ServerAlias www.yourdomain.com

    SSLEngine on

    SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem

    DocumentRoot /var/www/html

</VirtualHost>

Understanding the Configuration

SSLEngine: Enables SSL.

SSLEngine on

SSLCertificateFile: Points to the public certificate.

SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/fullchain.pem

SSLCertificateKeyFile: Points to the private key.

SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem

DocumentRoot: Specifies where your website files are stored.

DocumentRoot /var/www/html

For PHP or WordPress websites, this is typically your web root.

Reverse Proxy Example (Node.js, Django, Flask)

If Apache acts as a reverse proxy instead of serving static files, enable the required modules.

sudo a2enmod proxy
sudo a2enmod proxy_http
sudo systemctl restart apache2

Example VirtualHost:

<VirtualHost *:443>

    ServerName yourdomain.com

    SSLEngine on

    SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem

    ProxyPreserveHost On

    ProxyPass / http://localhost:3000/
    ProxyPassReverse / http://localhost:3000/

</VirtualHost>

If your application runs on another port (such as 4000, 5000, or 8080), simply update the ProxyPass and ProxyPassReverse directives to match.

5. Test Your Apache Configuration

Always verify the configuration before reloading Apache.

sudo apachectl configtest

Expected output:

Syntax OK

Reload Apache.

sudo systemctl reload apache2

Avoid restarting Apache without testing the configuration first to prevent unnecessary downtime caused by configuration errors.

6. Automatic SSL Renewal

Let’s Encrypt certificates are valid for 90 days.

When installed via apt, Certbot automatically creates a systemd timer (or a cron job on older Ubuntu versions) that:

• Runs twice daily
• Checks certificate expiration
• Renews certificates when needed
• Reloads Apache after successful renewal

Test Automatic Renewal

Simulate the renewal process.

sudo certbot renew --dry-run

Expected output:

Congratulations, all renewals succeeded.

Because this is a dry run, your live certificate remains unchanged.

Verify the Timer

systemctl list-timers | grep certbot

Example:

NEXT                         LEFT
Tue 2025-08-06 04:00 UTC     8h

UNIT
certbot.timer

This confirms that automatic renewal is scheduled correctly.

7. Manual Renewal

If you ever need to renew certificates manually:

sudo certbot renew

Reload Apache after renewal.

sudo systemctl reload apache2

8. Useful Apache SSL Commands

Check enabled sites.

sudo apache2ctl -S

List enabled modules.

sudo apache2ctl -M

Enable SSL module.

sudo a2enmod ssl

Enable Rewrite module.

sudo a2enmod rewrite

Enable Proxy modules.

sudo a2enmod proxy
sudo a2enmod proxy_http

Restart Apache.

sudo systemctl restart apache2

Reload Apache.

sudo systemctl reload apache2

9. Troubleshooting

Port 80 isn’t reachable

Let’s Encrypt must validate ownership using HTTP.

Verify your Security Group allows:

• TCP 80
• TCP 443

Also check the local firewall (if enabled):

sudo ufw status

Certificate generation fails

Verify that your DNS points to the correct EC2 public IP:

dig yourdomain.com +short

or

nslookup yourdomain.com

The returned IP should match your EC2 instance.

Apache configuration errors

Validate the configuration:

sudo apachectl configtest

Only reload Apache after you see:

Syntax OK

10. Final Thoughts

Setting up HTTPS on an Apache web server running on AWS EC2 is straightforward with Certbot and Let’s Encrypt. In just a few commands, you can secure your application with industry-standard encryption while benefiting from automated certificate management.

By completing this setup, you gain:

• Free SSL/TLS certificates from Let’s Encrypt
• Automatic HTTP to HTTPS redirection
• Automatic certificate renewal
• Encrypted communication between clients and your server
• Improved browser trust and better security for your applications

Whether you’re hosting a WordPress site, a PHP application, or using Apache as a reverse proxy for backend services, enabling HTTPS should always be one of the final steps before production. It not only protects your users’ data but also aligns with modern web security best practices and browser expectations.