A fresh WordPress site on Amazon Lightsail loads over plain HTTP, with no padlock and a "Not secure" warning in the address bar. Lightsail does not add HTTPS for you, but it does include everything you need to fix that for free. The Bitnami WordPress image ships with a tool that installs a Let's Encrypt certificate in a couple of minutes, and AWS never charges for the certificate itself. This guide covers the fast path with that tool, the manual route when it is missing, the option for a site behind a CDN or load balancer, and the steps most tutorials skip: opening the firewall, forcing HTTPS inside WordPress, and checking that renewal actually runs.
Before You Start: What SSL on Lightsail Needs
Three things have to be in place before any certificate will issue. Skip one and the install fails with an error that looks like a certificate problem but is really a setup problem.
- A static IP attached to your instance, so the address does not change on restart. If you have not done this yet, the steps are in our guide to installing WordPress on AWS Lightsail.
- Your domain pointing at that static IP with an A record, and enough time for the change to settle across DNS. Let's Encrypt confirms you own the domain by checking that it already resolves to the instance, so SSL will fail until the A record propagates.
- Port 443 open in the Lightsail firewall. Open the instance, go to the Networking tab, and under the IPv4 firewall make sure HTTPS on port 443 is allowed. This one setting is the most common reason a certificate installs cleanly but the padlock never appears.
Method 1: Free SSL With the Bitnami bncert Tool
This is the route AWS documents and the one to use for a standard Bitnami WordPress instance. It requests a free Let's Encrypt certificate, installs it, and configures the redirects, all from one command.
Run the bncert tool over SSH
Open the instance in the Lightsail console, click Connect using SSH to get a browser terminal, then run:
sudo /opt/bitnami/bncert-tool
The first run often offers to download a newer version of itself. Accept it, then run the same command again to start the real process. If you instead see "command not found", the tool is not on your image, so skip to Method 2.
Enter your domains
The tool asks which domains the certificate should cover. Enter your bare domain and the www version separated by a space, for example example.com www.example.com. Add any subdomains you serve, such as a blog or shop, on the same line. Wildcards are not supported here, which is the one case that sends you to Method 2.
Turn on the HTTP to HTTPS redirect
Next it offers to redirect every HTTP request to HTTPS, and to point the www version at the bare domain or the reverse. Say yes to the HTTPS redirect so visitors and search engines only ever reach the secure version. Give it an email address for expiry reminders, confirm, and it issues the certificate and restarts the web server. Load your site over https and you should see the padlock.
Method 2: When bncert Is Missing (Certbot)
AWS does not preinstall the bncert tool on every Lightsail WordPress image, and the tool cannot issue wildcard certificates. In either case the supported alternative is Certbot, the standard Let's Encrypt client. It runs on the same instance over SSH, proves you own the domain through a DNS record, and writes the certificate into the Apache configuration, and it can cover a wildcard that secures every subdomain at once. AWS publishes a Certbot walkthrough for Bitnami stacks that lists the exact commands for your image. Lightsail also offers a newer guided SSL workflow in the console that automates the whole install, and AWS now points people to it over the manual steps where the image supports it.
Method 3: SSL for a Lightsail Distribution or Load Balancer
The two methods above secure the instance itself. If you put something in front of the instance, the certificate goes there instead, and the rules change. This is where people get stuck, because a certificate that works in one place will not attach in another.
- Lightsail distribution (the built-in CDN). If you add a distribution to cache static files and speed up distant visitors, create a free Lightsail certificate and attach it to the distribution. It secures the edge while the distribution talks to your instance.
- Lightsail load balancer. Running more than one instance behind a load balancer, you attach a free Lightsail certificate to the balancer, which handles HTTPS for every instance behind it.
- Wider AWS with CloudFront. If you move up to CloudFront in front of the site, you request the certificate in AWS Certificate Manager instead, since that is what CloudFront accepts. Those certificates are free and renew on their own.
For a single WordPress instance with no CDN or load balancer, none of this applies, and Method 1 is all you need. Add a certificate at the edge only when a distribution, load balancer or CloudFront is already part of your setup.
Force HTTPS Across WordPress
Installing the certificate secures the connection, but WordPress can still serve links and images over plain HTTP, which shows up as a broken padlock or a mixed content warning. Two settings finish the job.
- In the WordPress dashboard, open Settings, then General, and make sure both the WordPress Address and Site Address start with https. Saving this signs you out, so log back in over https.
- Fix any assets still loading over http, usually old image or script URLs saved inside posts. A search-and-replace plugin, or a dedicated HTTPS helper plugin, rewrites them to https in one pass.
The redirect you turned on in Method 1 handles anyone who types the http address. These two settings make sure the pages themselves never ask for an insecure file.
Check the Certificate Is Working
Load your site with https in front of the address. A padlock with no warning means the certificate is installed and trusted. For a second opinion, run the domain through a free SSL checker, which confirms the certificate covers the right names, is trusted by browsers, and is not close to expiry. If the padlock shows but some page elements still warn, that is mixed content from the step above, not a fault with the certificate.
Keep SSL Renewing on Its Own
Let's Encrypt certificates last 90 days, which is short on purpose. The bncert tool sets up automatic renewal when it installs the certificate, so it renews well before expiry without you doing anything. You can leave it alone, but it is useful to know what keeps it working: a renewal runs on a schedule on the instance, and as long as your domain still points at the server and port 443 stays open, it keeps going. If you issued the certificate with Certbot by hand, add a scheduled renewal yourself, since a manual install does not set one up.
Common SSL Errors on Lightsail and How to Fix Them
Almost every failed certificate on Lightsail is one of these, and none of them need a support ticket:
- "Domain resolves to a different IP." Your A record is missing, wrong, or has not propagated. Point the domain at the static IP, wait, and run the tool again.
- The certificate installs but the padlock never appears. Port 443 is closed in the Lightsail firewall. Open the Networking tab and allow HTTPS on port 443.
- "Too many redirects." Something is forcing HTTPS twice, usually the bncert redirect plus a plugin or a Cloudflare setting doing the same. Turn one of them off.
- Mixed content warning. Pages still link to http images or scripts. Set both WordPress URLs to https and run a search-and-replace to rewrite the old links.
- "command not found" when running the tool. The bncert tool is not on your image, or you are in the wrong shell. Reconnect as the bitnami user, and if it is still absent, use Certbot from Method 2.
- The browser says the certificate is for the wrong name. It was issued without all your domains. Run the tool again and list every domain, including the www version, on one line.
Skip the Terminal: Managed SSL on AWS
Every step here is routine once you have done it, but it is still SSH, a firewall rule, and a renewal to keep half an eye on. If that is not how you want to spend your time, a managed host puts the same AWS hardware behind a dashboard and handles SSL for you. Cloudways runs a managed layer on AWS where issuing and renewing a Let's Encrypt certificate is a single click, with no terminal and nothing to maintain. It costs more per month than raw Lightsail, and in return every step on this page disappears. You can start a Cloudways trial on AWS, and the Cloudways hosting guide explains how the managed layer works. For how Lightsail, EC2 and the managed route compare on cost and effort, see the AWS WordPress hosting guide, and the Amazon Web Services review covers where AWS is worth the complexity.
