Setting up Nginx to Host a Web App Inside an EC2 Instance with Let’s Encrypt SSL Certificates

This guide will walk you through the steps to set up Nginx as a reverse proxy to host a web application inside an EC2 instance, with SSL certificates obtained from Let’s Encrypt using the Certbot tool. Additionally, we will configure Nginx to serve a microservice on a subdomain.

Prerequisites

• An EC2 instance running on Amazon Web Services (AWS)
• A registered domain name (e.g., example.com)
• Access to the EC2 instance via SSH

Step 1: Install Nginx

1. Connect to your EC2 instance via SSH.
2. Update the package index:

sudo apt-get update

3. Install Nginx:

sudo apt-get install nginx

Step 2: Install Certbot and Obtain SSL Certificates

1. Install Certbot and the Nginx plugin:

sudo apt-get install certbot python3-certbot-nginx

2. Obtain SSL certificates from Let’s Encrypt:

sudo certbot --nginx

Follow the prompts to enter your email address and agree to the terms of service. Choose the appropriate options to obtain certificates for your domain and subdomain.

Step 3: Configure Nginx

Create an Nginx configuration file for your web app, e.g., /etc/nginx/conf.d/example.com.conf, with the following content:

events {}

http {
    server {
        listen 80;
        server_name <example.com> api.<example.com>;
        return 301 https://$server_name$request_uri;
    }

    server {
        listen 443 ssl;
        server_name <example.com>;
        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        location / {
            proxy_pass http://localhost:3000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    server {
        listen 443 ssl;
        server_name api.<example.com>;
        ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;

        location / {
            proxy_pass http://localhost:8000;
            proxy_set_header Host $host;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_cache_bypass $http_upgrade;
            proxy_http_version 1.1;
        }
    }
}

Replace <example.com> with your actual domain name.

This configuration:

• Redirects HTTP traffic to HTTPS for the main domain and the api subdomain.
• Serves the web app on HTTPS for the main domain, proxying requests to http://localhost:3000.
• Serves a microservice on HTTPS for the api subdomain, proxying requests to http://localhost:8000.

Step 4: Start the Web App, Microservice, and Nginx

1. Start your web application to listen on port 3000.
2. Start your microservice to listen on port 8000.
3. Restart Nginx to apply the new configuration:

sudo systemctl restart nginx

Step 5: Test the Setup

Visit your domain and the api subdomain in a web browser to ensure that your web app and microservice are being served correctly over HTTPS, with the SSL certificates provided by Let’s Encrypt.

Renewing SSL Certificates

Let’s Encrypt SSL certificates are valid for 90 days. To renew the certificates automatically, you can set up a cron job to run the following command periodically:

sudo certbot renew --nginx

This command will check for expiring certificates and attempt to renew them if necessary.

That’s it! Your web app and microservice are now hosted securely inside an EC2 instance, with Nginx acting as a reverse proxy and providing SSL encryption using Let’s Encrypt certificates.