Automatically provisions and renews Let's Encrypt SSL certificates for AWS Elastic Load Balancers using Route53 DNS validation.
letsencrypt-aws is a Python-based automation tool that provisions and renews SSL certificates from Let's Encrypt for AWS Elastic Load Balancers. It solves the problem of manual certificate management by automatically handling the entire certificate lifecycle—from DNS validation via Route53 to uploading certificates to IAM and updating ELB configurations.
DevOps engineers and AWS administrators who manage multiple ELBs with SSL certificates and want to automate certificate renewal without manual intervention.
Developers choose letsencrypt-aws because it provides a lightweight, self-hosted alternative to manual certificate management or paid AWS services, with tight integration to AWS APIs and secure in-memory key handling.
letsencrypt-aws is a background service that automates SSL certificate management for AWS infrastructure. It continuously monitors Elastic Load Balancers (ELBs) and automatically renews expiring certificates through Let's Encrypt, eliminating manual certificate management overhead.
letsencrypt-aws follows a "set and forget" philosophy, designed to run autonomously in the background while maintaining security best practices for certificate management.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Runs daily checks and renews certificates expiring within 45 days, ensuring continuous SSL/TLS coverage without manual intervention, as described in the loop-based operation.
Uses AWS APIs to manage ELBs, IAM certificates, and Route53 DNS records, providing seamless automation within the AWS ecosystem, including DNS challenge validation.
Generates private keys in memory and uploads them directly to IAM without disk storage, enhancing security by minimizing exposure, as highlighted in the operational security section.
Available as a pre-built Docker image (alexgaynor/letsencrypt-aws), simplifying deployment and operation in containerized environments, as mentioned in the README.
Can run continuously with 24-hour sleep cycles using the --persistent flag, making it suitable for long-term, set-and-forget certificate management.
The README explicitly warns that the project is not well maintained, recommending alternatives like AWS Certificate Manager, which poses risks for long-term reliability.
Focuses solely on Elastic Load Balancers (ELBs), excluding modern AWS services such as Application Load Balancers (ALBs) or CloudFront, reducing its relevance for updated infrastructure.
Requires configuring IAM policies, ACME account registration, and JSON environment variables, which can be error-prone and daunting for users without deep AWS expertise.