🔐 How to Get an SSL Certificate on AWS Lightsail (Bitnami Stack)

🧠 What We’re Doing:

We’re going to use Let’s Encrypt, a free, automated SSL certificate provider, to secure your website hosted on a Bitnami stack in AWS Lightsail. Your site will go from http:// to https://, and your visitors’ data will be safe and sound!

🛠️ Prerequisites:

Before we start, make sure you have:

✅ A running Lightsail instance using a Bitnami stack (WordPress, LAMP, etc.)
✅ A domain name pointing to your Lightsail instance’s static IP
✅ SSH access to your Lightsail instance

🚀 Step-by-Step Guide:

Step 1: Connect to Your Instance via SSH

From the AWS Lightsail dashboard:

Go to the Lightsail console.
Click your instance.
Hit the “Connect using SSH” button.

💡 This opens a browser-based terminal. No extra software needed!

Step 2: Navigate to the Bitnami Directory

cd /opt/bitnami

This is the Bitnami root directory where all the good stuff lives.

Step 3: Run the Bitnami HTTPS Configuration Tool

Bitnami has a built-in tool to make this super easy!

sudo /opt/bitnami/bncert-tool

This tool:

Requests a Let’s Encrypt SSL certificate
Configures your domain to use HTTPS
Sets up automatic renewal (🤖 magic!)

You’ll Be Asked:

Your domain name(s) (e.g. example.com, www.example.com)
If you want to redirect HTTP to HTTPS (say yes!)
If you want to enable non-www to www redirect (or vice versa)

Answer the prompts and let it work its magic!

Step 4: Wait for the Tool to Finish

It might take a minute. If everything goes well, you’ll see a success message. Your site should now be using HTTPS!

Step 5 (Optional but Important): Test the HTTPS Setup

Open your site in a browser using https://yourdomain.com.

See the padlock icon? 🔒
No “Not secure” message? ✅
You’re good to go!

🧽 Bonus Tip: Automatic Renewal

The bncert-tool sets up a cron job to renew your SSL certificate automatically every 80 days. You can verify it like this:

sudo crontab -l

You should see something related to certificate renewal in there.

🧯 Troubleshooting Tips:

SSL Not Working? Check that your domain is pointed to your static IP and propagated (can take a few hours).
Tool not found? Run sudo /opt/bitnami/ctlscript.sh status to confirm you’re in a Bitnami stack.
Port 80/443 blocked? Make sure your Lightsail instance has networking rules allowing HTTP (80) and HTTPS (443).

Bonus IN depth

Ohhh yes, now we’re getting into the “Nerd Cave Bonus Level” 🧙‍♂️ — where we pop open the hood on Step 3 and really see what the bncert-tool is doing behind the scenes.

🔍 BONUS: Deep Dive Into Step 3 – The `bncert-tool` Unpacked

The Bitnami HTTPS Configuration Tool (bncert-tool) is like the friendly robot that handles a bunch of chores for you, but let’s break down exactly what it’s doing so you’re not just blindly trusting it like it’s an AI assistant or something 😅

🔧 What is `bncert-tool`?

It’s a utility script provided by Bitnami to:

Generate and install an SSL certificate from Let’s Encrypt
Configure Apache (or NGINX, if you’re wild like that)
Force HTTPS redirection
Set up auto-renewal using cron

Basically, it combines Certbot, Apache config editing, and task scheduling into one neat command.

📥 What Happens When You Run It?

Here’s what’s going on behind each prompt:

1️⃣ Enter Domain Names

Example:

example.com www.example.com

It tells Let’s Encrypt which domains you want the cert for. It verifies ownership via a challenge, usually over port 80.

⚠️ If your domain isn’t pointed to your Lightsail static IP, this step will fail.

2️⃣ Enable Redirection?

Redirect HTTP to HTTPS? → http://yourdomain.com → https://yourdomain.com
Redirect non-www to www (or vice versa)?

This modifies your Apache config files like:

<VirtualHost *:80>
  ...
  Redirect permanent / https://yourdomain.com/
</VirtualHost>

3️⃣ Let’s Encrypt Certificate Creation

Under the hood, it runs something like:

certbot certonly --webroot -w /opt/bitnami/apache2/htdocs -d example.com -d www.example.com

Let’s Encrypt sends a challenge to /.well-known/acme-challenge/, which certbot serves through Apache to prove ownership.

4️⃣ Apache Configuration Tweaks

It updates:

/opt/bitnami/apache2/conf/bitnami/bitnami.conf
/opt/bitnami/apache2/conf/bitnami/bitnami-ssl.conf

It adds SSL directives like:

SSLEngine on
SSLCertificateFile "/etc/letsencrypt/live/example.com/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/live/example.com/privkey.pem"

5️⃣ Automatic Renewal Setup

It adds a cron job like:

0 0 * * * /opt/bitnami/ctlscript.sh stop apache && \
certbot renew && \
/opt/bitnami/ctlscript.sh start apache

This runs daily at midnight, tries to renew the cert, and restarts Apache afterward.

🧠 Why This Is Cool:

Saves you from manually configuring Apache SSL, which is notoriously finicky
Handles Let’s Encrypt challenges and renewal seamlessly
Keeps everything in /opt/bitnami tidy and self-contained

If you’re ever curious, you can peek at your current cert info with:

sudo openssl x509 -in /etc/letsencrypt/live/YOURDOMAIN/fullchain.pem -text -noout

BONUS – Double down tut (new)

What we’ll do

Use the Bitnami HTTPS Configuration Tool (“bncert”) to request a Let’s Encrypt certificate.
Set up HTTPS (SSL), configure redirects (HTTP → HTTPS, www/non‑www if you want), and automatic renewal.

Prerequisites

Make sure you have:

A domain name you own.
The domain’s DNS records are pointing to your Lightsail instance’s public (static) IP.
SSH access to the Lightsail instance (via browser terminal or SSH key).
If it’s a WordPress or Bitnami app, ideally it has a static IP attached (so the IP won’t change) so SSL doesn’t break.

Step‑by‑step Guide

Here’s how to do it:

Step 1: Connect to your Lightsail instance

Go to the AWS Lightsail console.
Find your instance, open the SSH terminal (you can use the browser‑SSH or your local SSH if you have the key).

Step 2: Check if `bncert` tool is installed (and install if not)

Run:
```
sudo /opt/bitnami/bncert-tool
```
If it runs and you see something like “Welcome to the Bitnami HTTPS configuration tool,” good. If it says it’s not found, you’ll need to install it. (AWS Documentation)

To install it if missing:

wget -O bncert-linux-x64.run https://downloads.bitnami.com/files/bncert/latest/bncert-linux-x64.run
sudo mkdir /opt/bitnami/bncert
sudo mv bncert-linux-x64.run /opt/bitnami/bncert/
sudo chmod +x /opt/bitnami/bncert/bncert-linux-x64.run
sudo ln -s /opt/bitnami/bncert/bncert-linux-x64.run /opt/bitnami/bncert-tool

After that, try sudo /opt/bitnami/bncert-tool again. (AWS Documentation)

Step 3: Run the `bncert` tool to issue the certificate

Execute:
```
sudo /opt/bitnami/bncert-tool
```
It will prompt you for:
1. Your domain(s): e.g. example.com and maybe www.example.com.
2. Whether to redirect HTTP → HTTPS (you probably want yes).
3. Whether to redirect www → non‑www (or non‑www → www).
4. Your email address (for LetsEncrypt certificate registration/renewal notices).
Confirm all the prompts. The tool will:
- Validate your domain(s)
- Obtain the SSL certificate from Let’s Encrypt
- Configure the server (Apache/Nginx depending on stack) to use it
- Set up automatic renewal. (AWS Documentation)

Step 4: Test HTTPS & redirects

After bncert finishes, open a browser and go to https://yourdomain.com (and https://www.yourdomain.com if you added it).
Confirm the site loads without security warnings, the padlock shows up.
Check that http://yourdomain.com redirects to HTTPS.
Also test your www vs non‑www to make sure the redirection you chose works.

Optional / Alternative: Manual approach (if you want more control)

If bncert doesn’t cover your needs, you can do it manually (using Certbot or Lego). The manual steps are:

Stop your Bitnami services:
```
sudo /opt/bitnami/ctlscript.sh stop
```
Install a Let’s Encrypt client (e.g. Certbot or Lego).
Request the certificate using DNS or HTTP challenge.
Place the certificate files (cert, key, etc.) in the right Bitnami paths. For example:
```
/opt/bitnami/apache/conf/bitnami/certs/tls.crt  
/opt/bitnami/apache/conf/bitnami/certs/tls.key
```
(or wherever your stack expects them) (Bitnami Documentation)
Update configuration (Apache / Nginx config) to use the new cert/key.
Start services again:
```
sudo /opt/bitnami/ctlscript.sh start
```
Set up a cron job (or equivalent) to renew every ~90 days. (Bitnami Documentation)

Notes / Common Pitfalls

DNS must point properly before requesting the certificate. If the domain doesn’t resolve to your instance, validation fails.
If you stop/start the instance and don’t have a static IP, the public IP might change → SSL becomes invalid. So use a static IP.
Be careful with redirects (www vs non‑www) to avoid redirect loops.
Renewal: bncert automatically renews, but if doing manual, set up cron or scheduled job.
If you have a load balancer or CDN in front, things are slightly different (you might terminate SSL at the load balancer) — the basic approach still helps though.

How to set up SSL on AWS Bitnami