Updating TLS certs for using an S3 bucket which has been setup like a static website or you’re a dummy for not just using AWS certs. (Updated 12/26/25)

First make sure you have docker running on your system and run this command. I’m running Linux but should work on Mac & whatever the Windows Linux Subsystem is.

docker run -it --rm --name certbot -v "/etc/letsencrypt:/etc/letsencrypt" -v "/var/lib/letsencrypt:/var/lib/letsencrypt" certbot/certbot certonly --manual --agree-tos -d "your_domain.com" 

Next copy the code into text file and upload to S3 bucket specified by certbot. Quick way to do this is with the AWS CLI and issuing this command.

aws s3 cp FILENAME_THAT_CERTBOT_TOLD_YOU_TO_CREATE s3://your_website_s3_bucket/.well-known/acme-challenge/ --acl=public-read

Next import the certificates into certificate manager on AWS. Go to https://console.aws.amazon.com/acm/home?region=us-east-1# and make 100% sure that you AZ is set to us-east-1. Now find your sites domain and click on the hot linked Certificate ID.

Next change over to the directory /etc/letsencrypt/live/your_site (you’ll need root privileges) and in there are the sites privkey.pem, chain.pem, and cert.pem as well as fullchain which you don’t need. Copy the contents of each of the PEM files into the correct text box and click REIMPORT.

Next head over to the CloudFront section in AWS and find your CloudFront Distribution and click on it.. I only have one.

In the Settings section of the landing page click the edit button. Change nothing… and click SAVE

Wait a couple minutes and your certificate should be updated AND if you’re paranoid like I am use a tool like https://www.sslshopper.com/ssl-checker.html#hostname=YOUR_DOMAIN_HERE to check to see if the rest of the internet is seeing your brand new cert.

— 12/26/25 Note not sure how I totally forgot about the CloudFront potion of this how to but without it you wouldn’t have gotten anywhere.