AWS-Certbot

Auto renew letsencrypt.org SSL certificates provisioned on ACM.

Requirements

• Docker v24+

Quick Start

1. git clone [email protected]:j3ko/aws-certbot.git
   

2. cd aws-certbot
   

3. Edit .env.sample and fill in the required fields

4. Build the docker image

   docker build -t aws-certbot-builder .

5. Run aws-certbot locally

   docker run -it --rm --env-file=./.env.sample -v /var/run/docker.sock:/var/run/docker.sock aws-certbot-builder

What does it do?

Running aws-certbot locally will:

1. Check ACM to see if any domains in DOMAIN_LIST are expiring soon.
2. If domains are missing or expiring, certbot runs and generates a new SSL certificate
3. Any newly generated certificates are uploaded to ACM

Environment Variables

Variable	Description	Required?
APP_NAME	Name used for docker images/AWS resources	✅
AWS_ACCESS_KEY_ID	AWS access key	✅
AWS_SECRET_ACCESS_KEY	AWS secret access key	✅
AWS_DEFAULT_REGION	AWS region to use	✅
DOMAIN_LIST	A list of domains separated by commas and semicolons. The semicolon separates groups of domains, while commas separate individual domains. For example: domain.com,*.domain.com;example.io,staging.example.io	✅
DOMAIN_EMAIL	Cloudflare API key with edit.zone permissions	✅
DAYS_BEFORE_EXPIRATION	Number of days before expiration to request renewal	✅
LAMBDA_TIMEOUT	Lambda timeout in seconds	✅

Deploying to AWS

1. Edit .env.sample and fill in the required fields

2. Build the docker image

   docker build -t aws-certbot-builder .

3. Deploy aws-certbot to AWS

   docker run -it --rm --env-file=./.env.sample -v /var/run/docker.sock:/var/run/docker.sock aws-certbot-builder ./deploy.sh

What does it do?

1. The aws-certbot docker image is built and uploaded to ECR.
2. The cloud formation defined in cloud.yaml is deployed to run the docker image as a lambda function.
3. A timer is defined in cloud.yaml to execute the lambda function once a day.

Known Issues

• Only Cloudflare-managed domains can currently be used.
• Cloudflare API key is visible in lambda environment variables.

Credits

AWS-Certbot is based largely on the following amazing projects:

• https://arkadiyt.com/2018/01/26/deploying-effs-certbot-in-aws-lambda/
• https://github.com/kingsoftgames/certbot-lambda