Patches

Certificate Renewal

Deployments created prior to Jan 15th, 2021 using templates v1-5 and earlier do not auto-renew SSL certificates due to a bug. This has been resolved in a patch which needs to be manually applied.

Instructions

1. SSH into the EC2 server. If you require instructions on how to do so, follow the SSH Access Instructions.

2. When you have successfully opened a terminal to your server, type the commands after the $ sign below.
   Hit return/enter after each line.

   $ sudo su
   $ wget https://raw.githubusercontent.com/cat-box/aws-foundry-ssl/master/patches/certbot_cronjob.sh
   $ chmod a+x certbot_cronjob.sh
   $ ./certbot_cronjob.sh
   $ rm certbot_cronjob.sh

3. Reboot your server or wait until 12PM UTC the next day for certificate auto-renewal.

Confirm auto-renewal

There are two methods to check the status of your certificate, via crt.sh or terminal.

Method 1: crt.sh

1. Type in your domain (e.g. example.com).
2. On auto-renewal success, the top entry's "Logged At" column will be dated close to the date of your patch application.

Method 2: terminal

1. SSH into the EC2 server.

2. When you have successfully opened a terminal to your server, type the commands after the $ sign below.
   Hit return/enter after each line.

   $ sudo su
   $ certbot certificates

3. Check the "Expiry Date" line. An example output has been provided below.

   Found the following certs:
     Certificate Name: example.com
       Serial Number: [serial number here]
       Key Type: RSA
       Domains: foundry.example.com
       Expiry Date: 2021-04-16 12:00:00+00:00 (VALID: 89 days)
       Certificate Path: /etc/letsencrypt/live/foundry.example.com/fullchain.pem
       Private Key Path: /etc/letsencrypt/live/foundry.example.com/privkey.pem