Install a free SSL certificate on your Amazon Lightsail instance

A note from 2026: this was written for the 2017 Bitnami WordPress image. certbot-auto has since been retired; on a current image use the distribution's certbot package or Bitnami's bncert-tool, which handles the Apache configuration below for you. The steps are kept as originally published.

After recently discovering Amazon's Lightsail service and its simplicity when it comes to configuring and publishing a WordPress instance, I decided it would be wise to take it a step further and configure SSL.

Lightsail's WordPress instance comes with self-signed SSL certificates. Basically this means that any attempt to access my website via HTTPS would generate a security warning.

After a bit of searching, I came across a handy little service called Certbot which will assist us in solving this issue. The best part is it's a free, automated and open certificate authority. So this is what I will be using to secure my Lightsail instance running WordPress.

I went ahead and documented the process so that anyone can easily follow along in the future.

Let's begin

This guide assumes you've already set up a running instance of WordPress using Amazon's Lightsail service. If not, visit lightsail.aws.amazon.com.

Point your domain at the Lightsail instance's public IP. For the domain demosite.com this usually means an A record for demosite.com and a CNAME record for www.demosite.com pointing to demosite.com.

Verify that your website is accessible via HTTP and HTTPS, e.g. http://demosite.com and https://demosite.com.

Use the Lightsail console to open a terminal into your instance, then create a temporary directory:

mkdir tmp
cd tmp

Install Certbot as outlined on certbot.eff.org:

wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto

Create a .well-known directory in the WordPress htdocs directory:

mkdir /home/bitnami/apps/wordpress/htdocs/.well-known

Then create an .htaccess file in that directory:

touch /home/bitnami/apps/wordpress/htdocs/.well-known/.htaccess

Add the following contents to make the .well-known directory accessible:

#override overly protective .htaccess

RewriteEngine On
Satisfy Any

Edit the file using nano:

nano /home/bitnami/apps/wordpress/htdocs/.well-known/.htaccess

Run Certbot. Input your desired email address when prompted, and change demosite.com to your own domain:

./certbot-auto certonly --webroot -w /home/bitnami/apps/wordpress/htdocs/ -d demosite.com -d www.demosite.com

Assuming everything goes as planned, you'll see a message congratulating you for successfully acquiring the certificates.

Now edit the Apache configuration file with the new certificate information:

sudo nano /opt/bitnami/apache2/conf/bitnami/bitnami.conf

Comment out the following lines by adding a # to the front of each:

#SSLCertificateFile "/opt/bitnami/apache2/conf/server.crt"
#SSLCertificateKeyFile "/opt/bitnami/apache2/conf/server.key"

Add the following lines below the ones you just commented out, again substituting your domain:

# Certbot certificates
SSLCertificateFile "/etc/letsencrypt/live/demosite.com/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/live/demosite.com/privkey.pem"
SSLCACertificateFile "/etc/letsencrypt/live/demosite.com/fullchain.pem"

And to finish up, restart Apache:

sudo /opt/bitnami/ctlscript.sh restart apache

If everything goes to plan you will see the following output:

Unmonitored apache
Syntax OK
/opt/bitnami/apache2/scripts/ctl.sh : httpd stopped
Syntax OK
/opt/bitnami/apache2/scripts/ctl.sh : httpd started at port 80
Monitored apache

Validate the result by visiting your website via HTTPS, for example https://www.demosite.com.

Keep in mind these free certificates expire after 90 days. You can renew them manually every 90 days, or add a cron job that does it for you.