My website still not Secure

Question

Hi guys, I am still kind of new to this, but I have already purchase a domain in Route 53 and created it in Hosted Zone (automatically created upon purchasing), And I have already connected it to my EC2 instance via nginx inside by creating a new record which is "www.MyDomain.com" link/connect with my instance public ip.
Afterward, I created a certificate for my domain via ACM and created records of it in my Hosted Zone. Yet, my website still isn't secure. Any idea what I am doing wrong?
I followed this article in Medium.
https://aws.plainenglish.io/attach-ssl-certificate-and-domain-to-your-ec2-instance-using-route-53-and-aws-acm-28c9844a1a88
I heard there's a way with Load Balancer, but at the moment I don't think Load Balancer is needed since it a testing purposes.

Accepted Answer

To secure, you can install a SSL/TLS cert on your EC2 Nginx server for https. 
On most Linux OSs, you can install `certbot` and `python3-certbot-dns-route53`, and use it to obtain LetsEncrypt TLS cert with Route53 automatically.

```
sudo dnf install -y certbot python3-certbot-dns-route53
```
Replace `dnf` with `apt` if you are on Ubuntu

Assign Route53 [permission](https://certbot-dns-route53.readthedocs.io/en/stable/) (e.g. `AmazonRoute53FullAccess`) to your [EC2 IAM role](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html),

Since you have already created `www.MyDomain.com` DNS A record to your EC2 public IP,  run certbot in your Linux EC2 to request and auto install TLS cert on your Nginx web server, e.g.

```
sudo certbot --dns-route53 --installer nginx --agree-tos -d www.MyDomain.com
```

See screenshot below
![Enter image description here](/media/postImages/original/IMC8AGyImqStW4LUl-1cnQvA)

If above does not work, request for cert and manually install in your Nginx, e.g.  `sudo certbot certonly --dns-route53` or `sudo certbot certonly`

Answer

If you want to use an ACM certificate to secure your website you'll need to associate it with a load balancer or CloudFront distribution, and then put that in front of your EC2 instance https://repost.aws/knowledge-center/configure-acm-certificates-ec2

Specific details about **Load balancer** https://repost.aws/knowledge-center/associate-acm-certificate-alb-nlb

And **CloudFront** https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistS3AndCustomOrigins.html#concept_CustomOrigin

Both of these will incur additional costs, if you want to limit your costs then consider getting a LetsEncrypt certificate and using that directly in the Nginx config on your EC2 instance https://aws.amazon.com/blogs/compute/extending-amazon-linux-2-with-epel-and-lets-encrypt/ (a bit out of date) as well as https://letsencrypt.org/getting-started/

Answer

Hello.

If you do not use ALB, try using Let's Encrypt, which can issue SSL certificates for free, instead of ACM.  
Please refer to the following blog for information on how to issue a certificate.  
https://medium.com/@vinoji2005/guide-to-setup-lets-encrypt-ssl-in-nginx-be3d641bb58a

My website still not Secure

Relevant content