[ACM--AWS Certificate Manager]
                                              |
                                              | Certificate
                                              v  
                      [ client ] ========= [443 LB] ------- [80 HTTPD]

                                       [Third-Party CA]
                                              |
                                              | Certificate
                                              v  
                      [ client ] ========= [443 HTTPD]

$ sudo yum update -y
$ sudo yum install -y mod_ssl

#
# When we also provide SSL we have to listen to the 
# the HTTPS port in addition.
#
Listen 443 https

##
## SSL Virtual Host Context
##
<VirtualHost _default_:443>

# General setup for the virtual host, inherited from global configuration
#DocumentRoot "/var/www/html"
#ServerName www.example.com:443

# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

#   Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate.  If
# the certificate is encrypted, then you will be prompted for a
# pass phrase.  Note that a kill -HUP will prompt again.  A new
# certificate can be generated using the genkey(1) command.
SSLCertificateFile /etc/pki/tls/certs/localhost.crt

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convinience.
#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt

#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

#   Client Authentication (Type):
#   Client certificate verification type and depth.  Types are
#   none, optional, require and optional_no_ca.  Depth is a
#   number which specifies how deeply to verify the certificate
#   issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth  10

<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

</VirtualHost>                                  

$ cd /etc/pki/tls/certs
$ sudo ./make-dummy-cert localhost.crt

-----BEGIN PRIVATE KEY-----
...
...
...
-----END PRIVATE KEY-----                    

-----BEGIN CERTIFICATE-----
...
...
...
-----END CERTIFICATE-----

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
#SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

$ sudo systemctl restart httpd

If you are the website administrator:
You may now add content to the directory /var/www/html/. Note that until you do so, 
people visiting your website will see this page, and not your content. To prevent this page 
from ever being used, follow the instructions in the file /etc/httpd/conf.d/welcome.conf.

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

Issued To
Common Name (CN)	localhost.localdomain
Organization (O)	SomeOrganization
Organizational Unit (OU)	SomeOrganizationalUnit

Issued By
Common Name (CN)	localhost.localdomain
Organization (O)	SomeOrganization
Organizational Unit (OU)	SomeOrganizationalUnit

Validity Period:
Issued On	Monday, January 9, 2023 at 11:22:12 AM
Expires On	Tuesday, January 9, 2024 at 11:22:12 AM

SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

$ cd /home/ec2-user
$ sudo wget -r --no-parent -A 'epel-release-*.rpm' https://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/
$ sudo rpm -Uvh dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-*.rpm
$ sudo yum-config-manager --enable epel*

$ sudo amazon-linux-extras install epel -y
$ sudo yum install -y certbot python2-certbot-apache

$ sudo certbot --apache -d example1.com -d www.example1.com

$ sudo certbot --apache -d example1.com -d www.example1.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): <your_email_address>

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
Requesting a certificate for example1.com and www.example1.com
Performing the following challenges:
http-01 challenge for example1.com
http-01 challenge for www.example1.com
Waiting for verification...
Cleaning up challenges
Created an SSL vhost at /etc/httpd/conf/httpd-le-ssl.conf
Deploying Certificate to VirtualHost /etc/httpd/conf/httpd-le-ssl.conf
Enabling site /etc/httpd/conf/httpd-le-ssl.conf by adding Include to root configuration
Deploying Certificate to VirtualHost /etc/httpd/conf/httpd-le-ssl.conf
Redirecting vhost in /etc/httpd/conf/httpd.conf to ssl vhost in /etc/httpd/conf/httpd-le-ssl.conf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://example1.com and
https://www.example1.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/example1.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/example1.com/privkey.pem
   Your certificate will expire on 2023-04-09. To obtain a new or
   tweaked version of this certificate in the future, simply run
   certbot again with the "certonly" option. To non-interactively
   renew *all* of your certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

<VirtualHost *:443>
   ...
   ... CONTENT EXACTLY COPIED FROM <VirtualHost *:80>
   ...
   Include /etc/letsencrypt/options-ssl-apache.conf
   SSLCertificateFile /etc/letsencrypt/live/example1.com/fullchain.pem
   SSLCertificateKeyFile /etc/letsencrypt/live/example1.com/privkey.pem
</VirtualHost>

Include /etc/httpd/conf/httpd-le-ssl.conf

<VirtualHost *:80>
   ...
   ...
   ...
   RewriteEngine on
   RewriteCond %{SERVER_NAME} =www.example1.com [OR]
   RewriteCond %{SERVER_NAME} =example1.com
   RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

#
# When we also provide SSL we have to listen to the 
# the HTTPS port in addition.
#
#Listen 443 https -- from self-signed certificate settings
#--OR--
#NameVirtualHost *:443 -- NOT WORKING
#
Listen 443 https

<VirtualHost *:443>
   ServerName example1.com
   ServerAlias www.example1.com
   DocumentRoot /home/ec2-user/example1.com/html

   <Directory /home/ec2-user/example1.com/html>
     Options FollowSymLinks
     AllowOverride None
     Require all granted 
   </Directory>

   Include /etc/letsencrypt/options-ssl-apache.conf
   SSLCertificateFile /etc/letsencrypt/live/example1.com/fullchain.pem
   SSLCertificateKeyFile /etc/letsencrypt/live/example1.com/privkey.pem
</VirtualHost>

<VirtualHost *:443>
   ServerName example2.com
   ServerAlias www.example2.com
   DocumentRoot /home/ec2-user/example2.com/html

   <Directory /home/ec2-user/example2.com/html>
     Options FollowSymLinks
     AllowOverride None
     Require all granted 
   </Directory>

   Include /etc/letsencrypt/options-ssl-apache.conf
   SSLCertificateFile /etc/letsencrypt/live/example2.com/fullchain.pem
   SSLCertificateKeyFile /etc/letsencrypt/live/example2.com/privkey.pem
</VirtualHost>

sudo systemctl restart httpd

# nano /etc/crontab

21 3 * * * root certbot renew >/dev/null 2>&1

$ sudo systemctl restart crond