No public-facing web server. No quarterly DNS tickets. One controlled AWS setup and clear, repeatable Ubuntu commands.
Customize the guide ↓
Violet says: secure the process, automate the routine.A color-coded, step-by-step guide for two private Ubuntu 24.04 servers. Enter your names once; the certificate names, IAM permissions, commands, and instructions update immediately.
All initial names are examples. The guide assumes Apache and an existing APT-installed Certbot 2.9.0 or newer certificate for each hostname. No inbound public HTTP or HTTPS access is needed for DNS-01 validation.
Type the actual names below. All steps and copyable commands update as you type. Nothing is sent to a server or saved by this page. Never enter AWS access keys or passwords here.
Example: private-01 (no domain here)
Example: private-02 (no domain here)
Example: sub1 or team.office. Leave empty for no subdomain.
Example: smortler.com
Example: Smortler - not used in DNS records.
Starts with Z. Required to enable copying the IAM policy. Not an AWS secret.
Used in instructions only.
Used in instructions only.
private-01.sub1.smortler.comprivate-02.sub1.smortler.com_acme-challenge.private-01.sub1.smortler.com_acme-challenge.private-02.sub1.smortler.comcertbot certificates results must contain the exact full certificate names displayed above. If you have different names or a Snap-based installation, stop rather than blindly running these commands. Confirm that the DNS records are publicly served by Route 53 and that the AWS account owns the authoritative public hosted zone.If dig is available, these read-only checks can help identify the public authoritative DNS zone. Run them as root on private-01 - light green means Server 01. Some corporate networks block direct public resolver access; that alone does not prove DNS validation will fail.
dig @1.1.1.1 smortler.com NS +short
dig @1.1.1.1 sub1.smortler.com NS +short
dig @1.1.1.1 _acme-challenge.private-01.sub1.smortler.com SOA +noall +answer +authorityAn empty NS answer for the subdomain can be normal when it is not separately delegated. The authoritative SOA response can help identify the correct hosted zone. If dig is missing, Ubuntu provides it through dnsutils.
Only four AWS Console steps. Create one restricted IAM user or EC2 role that can modify the two exact TXT record names shown at the top. No permanent TXT records need to be created manually.
_acme-challenge.private-01.sub1.smortler.com and _acme-challenge.private-02.sub1.smortler.com. Normally this is smortler.com, unless the subdomain is separately delegated.If you cannot find the correct public zone in this AWS account, stop; the user or role must have permissions in the account that owns that zone.
smortler-Certbot-ExactTXT.{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DiscoverHostedZones",
"Effect": "Allow",
"Action": "route53:ListHostedZones",
"Resource": "*"
},
{
"Sid": "ReadDNSChangeStatus",
"Effect": "Allow",
"Action": "route53:GetChange",
"Resource": "arn:aws:route53:::change/*"
},
{
"Sid": "ChangeOnlyTwoChallengeTXTRecords",
"Effect": "Allow",
"Action": "route53:ChangeResourceRecordSets",
"Resource": "arn:aws:route53:::hostedzone/YOUR_PUBLIC_HOSTED_ZONE_ID",
"Condition": {
"ForAllValues:StringEquals": {
"route53:ChangeResourceRecordSetsNormalizedRecordNames": [
"_acme-challenge.private-01.sub1.smortler.com",
"_acme-challenge.private-02.sub1.smortler.com"
],
"route53:ChangeResourceRecordSetsRecordTypes": ["TXT"],
"route53:ChangeResourceRecordSetsActions": ["CREATE", "UPSERT", "DELETE"]
},
"Null": {
"route53:ChangeResourceRecordSetsNormalizedRecordNames": "false",
"route53:ChangeResourceRecordSetsRecordTypes": "false",
"route53:ChangeResourceRecordSetsActions": "false"
}
}
}
]
}Only these two names: _acme-challenge.private-01.sub1.smortler.com and _acme-challenge.private-02.sub1.smortler.com. The policy does not grant record changes to A, AAAA, CNAME, MX, NS, SOA, or any other TXT names. Do not attach broader Route 53 permissions. Listing hosted zone names and reading change status remain read-only.
smortler-certbot-dns.smortler-Certbot-ExactTXT, and finish creating the user.For AWS EC2 VMs: an IAM instance role attached to each EC2 instance is preferable to long-lived keys. The same restricted policy can be attached to the appropriate instance role; skip Step 4 and the credentials-file steps below if that is the chosen method.
Never paste the access key, secret key, or passwords into this website, documentation, tickets, or plain-text email. Separate IAM users for the two servers provide additional isolation if desired; this page uses the simpler one-user setup.
private-01Run this entire section as root on private-01 (certificate: private-01.sub1.smortler.com). Assigned administrator: Local Server Admin.
Check that the current certificate already exists and its Certificate Name exactly matches private-01.sub1.smortler.com. These commands assume Ubuntu 24.04 with APT-installed Certbot. If Certbot uses Snap instead, stop and use the matching Snap plugin.
command -v certbot
certbot --version
certbot certificatesIf the certificate is missing or has a different Certificate Name (such as a -0001 suffix), stop and correct the inputs or consult your server administrator. Do not issue a duplicate certificate.
apt update
apt install -y python3-certbot-dns-route53
certbot pluginsConfirm the plugin listing includes dns-route53 before continuing.
Keep the existing certificate and Apache configuration unchanged. This is a one-time backup of the renewal settings only.
cp -an /etc/letsencrypt/renewal/private-01.sub1.smortler.com.conf /root/private-01-renewal-before-route53.confIf the source file is missing or the command fails, stop. The backup will not overwrite an existing backup with the same name.
If AWS issued an IAM user access key, check for any existing credentials first. Do not overwrite an existing AWS credentials file that another application uses. AWS secrets must never be entered on this web page.
ls -ld /root/.aws 2>/dev/null || true
ls -l /root/.aws/credentials 2>/dev/null || trueIf it is safe to create or edit that file:
install -d -m 700 /root/.aws
touch /root/.aws/credentials
chmod 600 /root/.aws/credentials
nano /root/.aws/credentialsPlace the access key and secret provided securely by DNS Admin in the file as follows. These are placeholders, not real keys:
[default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEYSave Nano with Ctrl+O, Enter, then Ctrl+X. Restrict the file permissions:
chown root:root /root/.aws/credentials
chmod 600 /root/.aws/credentialsEC2 IAM role alternative: if DNS Admin attached the exact-record policy to an instance role assigned to this server, skip all file-creation commands in this step.
reconfigure performs a Let's Encrypt staging test and saves the new authenticator only on success. It does not replace the current live certificate. Do not use certonly or --force-renewal.
certbot reconfigure --cert-name private-01.sub1.smortler.com --authenticator dns-route53Confirm the renewal file now contains authenticator = dns-route53:
grep '^authenticator *=' /etc/letsencrypt/renewal/private-01.sub1.smortler.com.confIf the test fails, stop here. Do not modify or delete the live certificate. See Troubleshooting below.
This deploy hook runs only after successful certificate issuance or renewal. It tests the Apache configuration before reloading. Inspect any existing renewal hooks if this server already has customized Certbot automation.
ls -l /etc/letsencrypt/renewal-hooks/deploy/ 2>/dev/null || trueCreate a separate hook for Apache (does not edit virtual hosts or certificate paths):
install -d -m 755 /etc/letsencrypt/renewal-hooks/deploy
cat > /etc/letsencrypt/renewal-hooks/deploy/reload-apache-dns01.sh <<'EOF'
#!/bin/sh
set -eu
/usr/sbin/apache2ctl configtest
/bin/systemctl reload apache2
EOF
chmod 755 /etc/letsencrypt/renewal-hooks/deploy/reload-apache-dns01.shEnable the Certbot systemd timer that comes with the Ubuntu APT package; do not add a cron job as well.
systemctl enable --now certbot.timer
systemctl is-active certbot.timer
systemctl list-timers --all certbot.timerFinally, perform a full staging dry run and run the deploy hook against the current live certificate:
certbot renew --cert-name private-01.sub1.smortler.com --dry-run --run-deploy-hooks
certbot certificates
systemctl is-active apache2Success means: dry run succeeds, Apache remains active, Certbot's timer is active, and the existing certificate name and paths remain unchanged.
private-02Run this entire section as root on private-02 (certificate: private-02.sub1.smortler.com). Assigned administrator: Local Server Admin.
Do not start until Server 01 has passed its dry run.
Check that the current certificate already exists and its Certificate Name exactly matches private-02.sub1.smortler.com. These commands assume Ubuntu 24.04 with APT-installed Certbot. If Certbot uses Snap instead, stop and use the matching Snap plugin.
command -v certbot
certbot --version
certbot certificatesIf the certificate is missing or has a different Certificate Name (such as a -0001 suffix), stop and correct the inputs or consult your server administrator. Do not issue a duplicate certificate.
apt update
apt install -y python3-certbot-dns-route53
certbot pluginsConfirm the plugin listing includes dns-route53 before continuing.
Keep the existing certificate and Apache configuration unchanged. This is a one-time backup of the renewal settings only.
cp -an /etc/letsencrypt/renewal/private-02.sub1.smortler.com.conf /root/private-02-renewal-before-route53.confIf the source file is missing or the command fails, stop. The backup will not overwrite an existing backup with the same name.
If AWS issued an IAM user access key, check for any existing credentials first. Do not overwrite an existing AWS credentials file that another application uses. AWS secrets must never be entered on this web page.
ls -ld /root/.aws 2>/dev/null || true
ls -l /root/.aws/credentials 2>/dev/null || trueIf it is safe to create or edit that file:
install -d -m 700 /root/.aws
touch /root/.aws/credentials
chmod 600 /root/.aws/credentials
nano /root/.aws/credentialsPlace the access key and secret provided securely by DNS Admin in the file as follows. These are placeholders, not real keys:
[default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEYSave Nano with Ctrl+O, Enter, then Ctrl+X. Restrict the file permissions:
chown root:root /root/.aws/credentials
chmod 600 /root/.aws/credentialsEC2 IAM role alternative: if DNS Admin attached the exact-record policy to an instance role assigned to this server, skip all file-creation commands in this step.
reconfigure performs a Let's Encrypt staging test and saves the new authenticator only on success. It does not replace the current live certificate. Do not use certonly or --force-renewal.
certbot reconfigure --cert-name private-02.sub1.smortler.com --authenticator dns-route53Confirm the renewal file now contains authenticator = dns-route53:
grep '^authenticator *=' /etc/letsencrypt/renewal/private-02.sub1.smortler.com.confIf the test fails, stop here. Do not modify or delete the live certificate. See Troubleshooting below.
This deploy hook runs only after successful certificate issuance or renewal. It tests the Apache configuration before reloading. Inspect any existing renewal hooks if this server already has customized Certbot automation.
ls -l /etc/letsencrypt/renewal-hooks/deploy/ 2>/dev/null || trueCreate a separate hook for Apache (does not edit virtual hosts or certificate paths):
install -d -m 755 /etc/letsencrypt/renewal-hooks/deploy
cat > /etc/letsencrypt/renewal-hooks/deploy/reload-apache-dns01.sh <<'EOF'
#!/bin/sh
set -eu
/usr/sbin/apache2ctl configtest
/bin/systemctl reload apache2
EOF
chmod 755 /etc/letsencrypt/renewal-hooks/deploy/reload-apache-dns01.shEnable the Certbot systemd timer that comes with the Ubuntu APT package; do not add a cron job as well.
systemctl enable --now certbot.timer
systemctl is-active certbot.timer
systemctl list-timers --all certbot.timerFinally, perform a full staging dry run and run the deploy hook against the current live certificate:
certbot renew --cert-name private-02.sub1.smortler.com --dry-run --run-deploy-hooks
certbot certificates
systemctl is-active apache2Success means: dry run succeeds, Apache remains active, Certbot's timer is active, and the existing certificate name and paths remain unchanged.
Complete the steps in order. Use the checkboxes to track progress (they are not saved to the server).
To check renewal status later, run these read-only commands on the appropriate machine (one green block and one blue block):
certbot certificates
systemctl list-timers --all certbot.timer
journalctl -u certbot.service -n 60 --no-pagercertbot certificates
systemctl list-timers --all certbot.timer
journalctl -u certbot.service -n 60 --no-pagerConfirm the authoritative PUBLIC hosted zone for sub1.smortler.com and each challenge name is in the same AWS account. If a subdomain has its own NS delegation, the public hosted zone may be the subdomain, not the base domain. A duplicate undelegated zone is not enough. The Certbot plugin discovers hosted zones automatically; it must find the actual authoritative one.
Check that the Hosted Zone ID entered above is correct, the identity has the policy attached, and the requested TXT name is exactly _acme-challenge.private-01.sub1.smortler.com or _acme-challenge.private-02.sub1.smortler.com. Do not fix this by giving Route 53 administrator permissions. If using an EC2 role, confirm which role is attached to the actual instance.
Check that the access key is configured as [default] in /root/.aws/credentials, root owns the file, and its permissions are 600. If there are other applications using AWS credentials, review that configuration before changing it.
Use certbot certificates to discover the real Certificate Name. The name may differ from a DNS hostname. The commands in this guide assume both match. If not, stop and adapt the certificate-name and filename values with the server administrator; do not create a duplicate certificate.
Check outbound HTTPS and working DNS. DNS-01 challenge TXT records must be available in the public authoritative zone. The plugin deletes the temporary challenge record after validation, so an empty query afterward is normal. Review /var/log/letsencrypt/letsencrypt.log.
On the failing server, run apache2ctl configtest and systemctl status apache2. Fix Apache configuration first; the hook must not interrupt an otherwise working site. The page intentionally does not rewrite your Apache configuration.
Stop and keep using the existing valid certificate. Do not delete certificates, manually edit the renewal file, run certonly for the same name, or force a live renewal until you have diagnosed the problem.
From any Linux machine with dig, query a public resolver with dig @1.1.1.1 for the NS records of the base domain and SOA for the challenge hostname. If the subdomain has separate NS delegation, identify that public zone. Public DNS may differ from internal split DNS.
SMORTLER HowTo - Return to HowTo Index. No passwords or AWS credentials are accepted. Custom entries are processed only in your browser and reset when you reload.