Problem: SSL Certificate Not Working on AWS Lightsail – "Your Connection is Not Private"

Problem: SSL Certificate Not Working on AWS Lightsail – "Your Connection is Not Private"

Common Error Messages:

# Browser error (Chrome)
Your connection is not private
NET::ERR_CERT_AUTHORITY_INVALID

# Browser error (Firefox)
Warning: Potential Security Risk Ahead
SEC_ERROR_UNKNOWN_ISSUER

# Curl command failure
curl -I https://mydomain.com
curl: (60) SSL certificate problem: unable to get local issuer certificate

Issue:
Your AWS Lightsail instance has SSL certificate issues, preventing users from securely accessing your website. This usually happens due to:

• Let's Encrypt SSL Expired – Certificates auto-renew every 90 days, but renewal might have failed.
• Incorrect Certificate Installation – The certificate chain may be incomplete or misconfigured.
• DNS Issues with Domain – The domain may not be pointing to the correct instance.
• Port 443 is Blocked – The instance firewall may be blocking HTTPS traffic.
• Lightsail’s Free SSL Not Applied – If using Lightsail’s built-in SSL, it may not be activated properly.

Fix: Check SSL Status and Apply a Fix

# Step 1: Check if the SSL certificate is valid
$ openssl s_client \
    -connect mydomain.com:443 \
    -servername mydomain.com | openssl x509 \
    -noout \
    -dates

# Expected Output...
notBefore=Feb 1 00:00:00 2025 GMT
notAfter=May 1 00:00:00 2025 GMT

# If "notAfter" date is past, the certificate is expired. Proceed to Step 2.

# Step 2: Check if Let's Encrypt SSL auto-renewal failed
$ sudo certbot renew --dry-run

# Expected Output (Success)...
Congratulations, all renewals succeeded. No further action is required.

# Expected Output (Fail)...
Attempting to renew cert (mydomain.com) from  
/etc/letsencrypt/renewal/mydomain.com.conf produced an unexpected error:  

urn:ietf:params:acme:error:unauthorized ::  
The client lacks sufficient authorization ::  

Invalid response from  
https://mydomain.com/.well-known/acme-challenge/...  
[54.123.45.67]: 404

# If renewal fails, manually renew the SSL certificate
$ sudo certbot renew

# Restart web server to apply changes
$ sudo systemctl restart apache2  # If using Apache
$ sudo systemctl restart nginx    # If using Nginx

# Step 3: Check if the certificate chain is incomplete
$ curl -vI https://mydomain.com

# Expected Output (Correct SSL Chain)...
* SSL connection using TLSv1.2
* Server certificate:
*  subject: CN=mydomain.com
*  start date: Feb 1 00:00:00 2025 GMT
*  expire date: May 1 00:00:00 2025 GMT

# If the chain is incomplete, reconfigure Certbot to serve the full chain
$ sudo certbot certificates

# Find the certificate path and reconfigure the web server:
$ sudo nano /etc/apache2/sites-available/default-ssl.conf  # Apache
$ sudo nano /etc/nginx/sites-available/default             # Nginx

# Apache Configuration (Add/Edit these lines inside the 
# <VirtualHost *:443> block)
SSLCertificateFile /etc/letsencrypt/live/mydomain.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem

# Nginx Configuration (Inside server { ... } block)
server {
    listen 443 ssl;
    server_name mydomain.com;

    ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;

    location / {
        root /var/www/html;
        index index.html index.htm;
    }
}

# Restart Apache or Nginx to apply changes
$ sudo systemctl restart apache2  # Apache
$ sudo systemctl restart nginx    # Nginx

# Step 4: Verify DNS is correctly configured for the domain
$ dig +short mydomain.com

# Expected Output...
54.123.45.67  (Your Lightsail instance's public IP)

# If incorrect, update your domain A record at your DNS provider.

# Step 5: Ensure port 443 (HTTPS) is open in the Lightsail firewall
$ aws lightsail get-instance-port-states --instance-name "WebServer"

# Expected Output (Port 443 must be listed)...
[
  {
    "fromPort": 443,
    "toPort": 443,
    "protocol": "TCP",
    "state": "open"
  }
]

# If port 443 is not open, allow HTTPS traffic:
$ aws lightsail open-instance-public-ports \
    --instance-name "WebServer" \
    --port-info fromPort=443,toPort=443,protocol=TCP

# Step 6: If using Lightsail’s Free SSL, reapply it
$ sudo certbot --apache   # If using Apache
$ sudo certbot --nginx    # If using Nginx

# Restart the web server
$ sudo systemctl restart apache2
$ sudo systemctl restart nginx

# FINAL STEP: Verify SSL certificate is valid
$ curl -I https://mydomain.com

# Expected Output (Successful SSL Connection)...
HTTP/2 200 
server: Apache/2.4.41 (Ubuntu)
content-type: text/html

Need AWS Expertise?

If you're looking for guidance on Amazon Lightsail or any cloud challenges, feel free to reach out! We'd love to help you tackle your Lightsail projects. 🚀

Email us at: info@pacificw.com

Image: Gemini