AWS lightsail documentation change
Summary
Restructured the guide to use a guided setup workflow for WordPress instances, replacing the manual bncert tool steps. Added separate instructions for Lightsail and Bitnami blueprints, including domain setup, DNS management, static IP, and SSL/TLS certificate configuration.
Security assessment
The change focuses on improving HTTPS setup documentation but doesn't address any specific vulnerability. It adds security documentation by detailing SSL/TLS certificate configuration and emphasizing encrypted HTTPS connections, which enhances security posture by promoting secure defaults.
Diff
diff --git a/lightsail/latest/userguide/amazon-lightsail-enabling-https-on-wordpress.md b/lightsail/latest/userguide/amazon-lightsail-enabling-https-on-wordpress.md index 81ec974b6..33c41b8f6 100644 --- a//lightsail/latest/userguide/amazon-lightsail-enabling-https-on-wordpress.md +++ b//lightsail/latest/userguide/amazon-lightsail-enabling-https-on-wordpress.md @@ -7,2 +6,0 @@ -Step 1: Learn about the processStep 2: Complete the prerequisitesStep 3: Connect to your instanceStep 4: Confirm the bncert tool is installed on your instanceStep 5: Enable HTTPS on your WordPress instanceStep 6: Test that your website is using HTTPS - @@ -13 +11 @@ Enabling Hypertext Transfer Protocol Secure (HTTPS) for your WordPress website a -###### Tip +Here are a few steps you should take to setup SSL certificates after your WordPress instance is up and running on Amazon Lightsail. Before you get started, identify your blueprint vendor on your instance management page: @@ -15 +13 @@ Enabling Hypertext Transfer Protocol Secure (HTTPS) for your WordPress website a -Lightsail offers a guided workflow that automates the installation and configuration of an SSL/TLS Let's Encrypt certificate on your WordPress instance. We highly recommend that you use the workflow instead of following the manual steps in this tutorial. For more information, see [Launch and configure a WordPress instance](./amazon-lightsail-tutorial-launching-and-configuring-wordpress.html). + @@ -17 +15 @@ Lightsail offers a guided workflow that automates the installation and configura -This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) to enable HTTPS on your _Certified by Bitnami_ WordPress instance on Amazon Lightsail. It lets you request certificates only for the domains and subdomains that you specify when making your request. Alternately, you can use the Certbot tool, which lets you request a certificate for domains and a wildcard certificate for subdomains. A wildcard certificate works for _any_ subdomains of a domain, which is beneficial if you don't know which subdomains you will use to direct traffic to your instance. However, Certbot does not automatically renew your certificate like the `bncert` tool. If you use Certbot, you have to manually renew your certificates every 90 days. For more information about using Certbot to enable HTTPS, see [Tutorial: Use Let’s Encrypt SSL certificates with your WordPress instance](./amazon-lightsail-using-lets-encrypt-certificates-with-wordpress.html). +Select the appropriate guide for your WordPress instance: @@ -19 +17 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) -**Contents** +Lightsail @@ -21 +18,0 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) - * Step 1: Learn about the process @@ -23 +20 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) - * Step 2: Complete the prerequisites +## Step 1: Configure your WordPress instance @@ -25 +22 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) - * Step 3: Connect to your instance +You can configure your WordPress instance by using a guided, step-by-step workflow that will configure the following: @@ -27 +24 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) - * Step 4: Confirm the bncert tool is installed on your instance + * A registered domain name – Your WordPress site needs a domain name that is easy to remember. Users will specify this domain name to access your WordPress site. For more information, see [Register and manage domains for your website in Lightsail](./amazon-lightsail-domain-registration.html). @@ -29 +26 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) - * Step 5: Enable HTTPS on your WordPress instance + * DNS management – You must decide how to manage the DNS records for your domain. A DNS record tells the DNS server which IP address or hostname a domain or subdomain is associated with. A DNS zone contains the DNS records for your domain. For more information, see [Understanding DNS in Lightsail](./understanding-dns-in-amazon-lightsail.html). @@ -31 +28 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) - * Step 6: Test that your website is using HTTPS + * A Static IP address – The default public IP address for your WordPress instance changes if you stop and start your instance. When you attach a static IP address to your instance, it stays the same even if you stop and start your instance. For more information, see [View and manage IP addresses for Lightsail resources](./understanding-public-ip-and-private-ip-addresses-in-amazon-lightsail.html). @@ -32,0 +30 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) + * An SSL/TLS certificate – After you create a validated certificate and install it on your instance, you can enable HTTPS for your WordPress website so that traffic that is routed to the instance through your registered domain is encrypted using HTTPS. For more information, see [Secure your WordPress site with HTTPS on Lightsail](./amazon-lightsail-enabling-https-on-wordpress.html). @@ -36 +33,0 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) -## Step 1: Learn about the process @@ -38 +35 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) -###### Note +###### Tip @@ -40 +37 @@ This guide shows you how to use the Bitnami HTTPS configuration tool (`bncert`) -In this section, you get a high-level overview of the process. The specific steps to perform this process are included in the subsequent steps of this guide. +Review the following tips before you begin. For troubleshooting information, see [Troubleshooting WordPress setup](./amazon-lightsail-troubleshooting-wp-setup.html). @@ -42 +39 @@ In this section, you get a high-level overview of the process. The specific step -To enable HTTPS for your WordPress website, connect to your Lightsail instance using SSH, and use the `bncert` tool to request an SSL/TLS certificate from the [Let's Encrypt](https://letsencrypt.org/about/) certificate authority. When you request the certificate, you specify your website's primary domain (`example.com`) and alternate domains (`www.example.com`, `blog.example.com`, etc.), if any. Let's Encrypt validates that you own the domains either by asking you to create TXT records in the DNS of your domains, or by verifying that those domains are already directing traffic to the public IP address of the instance from which you make the request. + * Your instance must be in a **Running** state. Allow a few minutes for the SSH connection to become ready if the instance was just started. @@ -44 +41 @@ To enable HTTPS for your WordPress website, connect to your Lightsail instance u -After your certificate is validated, you can configure your WordPress website to automatically redirect visitors from HTTP to HTTPS (`http://example.com` redirects to `https://example.com`) so that visitors are forced to use the encrypted connection. You can also configure your website to automatically redirect the `www` subdomain to the apex of your domain (`https://www.example.com` redirects to `https://example.com`) or vice versa (`https://example.com` redirects to `https://www.example.com`). These redirections are also configured using the `bncert` tool. + * Ports 22, 80, and 443 on your instance firewall must allow TCP connections from any IP address while setup is running. For more information, see [Instance firewalls](./understanding-firewall-and-port-mappings-in-amazon-lightsail.html). @@ -46 +43 @@ After your certificate is validated, you can configure your WordPress website to -Let's Encrypt requires that you renew your certificate every 90 days to maintain HTTPS on your website. The `bncert` tool automatically renews your certificates for you, so that you can spend more time focusing on your website. + * When you add or update DNS records that point traffic from your apex domain (`example.com`) and its `www` subdomains (`www.example.com`), they will need to propagate throughout the Internet. You can verify that your DNS changes have taken effect by using tools such as [nslookup](https://aws.amazon.com/blogs//messaging-and-targeting/how-to-check-your-domain-verification-settings/), or [DNS Lookup](https://mxtoolbox.com/DnsLookup.aspx) from _MxToolbox_. @@ -48 +45 @@ Let's Encrypt requires that you renew your certificate every 90 days to maintain -**Limitations of the bncert tool** + * Let's Encrypt certificates will automatically renew every 60 to 90 days. @@ -50 +47 @@ Let's Encrypt requires that you renew your certificate every 90 days to maintain -The `bncert` tool has the following limitations: + * While setup is in progress, do not stop or make changes to your instance. It can take up to 15 minutes to configure your instance. You can view the progress for each step in the instance connect tab. @@ -52 +48,0 @@ The `bncert` tool has the following limitations: - * It's not preinstalled on all _Certified by Bitnami_ WordPress instances when they're created. WordPress instances that were created on Lightsail a while back will require that you manually install the `bncert` tool. Step 4 of this guide shows you how to confirm that the tool is installed on your instance, and how to install it if it's not. @@ -54 +49,0 @@ The `bncert` tool has the following limitations: - * You can request certificates only for the domains and subdomains that you specify when making your request. This is different than the Certbot tool, which lets you request a certificate for domains and a wildcard certificate for subdomains. A wildcard certificate works for _any_ subdomains of a domain, which is beneficial if you don't know which subdomains you will use to direct traffic to your instance. However, Certbot does not automatically renew your certificate like the `bncert` tool. If you use Certbot, you have to manually renew your certificates every 90 days. For more information about using Certbot to enable HTTPS, see [Tutorial: Using Let’s Encrypt SSL certificates with your WordPress instance in Amazon Lightsail](./amazon-lightsail-using-lets-encrypt-certificates-with-wordpress.html). @@ -56,0 +52 @@ The `bncert` tool has the following limitations: +###### To configure your instance using the website setup wizard @@ -57,0 +54 @@ The `bncert` tool has the following limitations: + 1. On the instance management page, on the **Connect** tab, choose **Set up your website**. @@ -59 +56 @@ The `bncert` tool has the following limitations: -## Step 2: Complete the prerequisites + @@ -61 +58 @@ The `bncert` tool has the following limitations: -Complete the following prerequisites if you haven’t already done so: + 2. For **Specify a domain name** , use an existing Lightsail managed domain, register a new domain with Lightsail, or use a domain that you registered by using another domain registrar. Choose **Use this domain** to go to the next step. @@ -63 +60 @@ Complete the following prerequisites if you haven’t already done so: - * Create a WordPress instance in Lightsail, and configure your website on your instance. For more information, see [Get started with Linux/Unix-based instances in Amazon Lightsail](./getting-started-with-amazon-lightsail.html). + 3. For **Configure DNS** , do one of the following: @@ -65 +62 @@ Complete the following prerequisites if you haven’t already done so: - * Attach a static IP to your instance. Your instance's public IP address changes if you stop and start your instance. A static IP does not change if you stop and start your instance. For more information, see [Create a static IP and attach it to an instance in Amazon Lightsail](./lightsail-create-static-ip.html). + * Choose **Lightsail managed domain** to use a Lightsail DNS zone. Choose **Use this DNS zone** to go to the next step. @@ -67 +64 @@ Complete the following prerequisites if you haven’t already done so: - * Create a snapshot of your WordPress instance after you're done configuring it, or enable automatic snapshots. The snapshot can be used as a backup from which you can create another instance in case something goes wrong with your original instance. For more information, see [Create a snapshot of your Linux or Unix instance](./lightsail-how-to-create-a-snapshot-of-your-instance.html) or [Enabling or disabling automatic snapshots for instances or disks in Amazon Lightsail](./amazon-lightsail-configuring-automatic-snapshots.html). + * Choose **Third-party domain** to use the hosting service that manages the DNS records for your domain. Note that we create a matching DNS zone in your Lightsail account in case you decide to use it later on. Choose **Use third-party DNS** to go to the next step. @@ -69 +66 @@ Complete the following prerequisites if you haven’t already done so: - * Add DNS records to the DNS of your domain that directs traffic for the apex of your domain (`example.com`) and for its `www` subdomain (`www.example.com`) to the public IP address of your WordPress instance in Lightsail. You can complete these actions at your domain's current DNS hosting provider. Or if you transferred management of your domain's DNS to Lightsail, you can complete these actions using a DNS zone in Lightsail. To learn more, see [DNS](./understanding-dns-in-amazon-lightsail.html). + 4. For **Create a static IP address** , enter a name for your static IP address and then choose **Create static IP**. @@ -71 +68 @@ Complete the following prerequisites if you haven’t already done so: -###### Important + 5. For **Manage domain assignments** , choose **Add assignment** , choose a domain type, and then choose **Add**. Choose **Continue** to go to the next step. @@ -73 +70 @@ Complete the following prerequisites if you haven’t already done so: -Add DNS records to the DNS of all domains that you want use with your WordPress website. All of those domains should be routing traffic to the public IP address of your WordPress website. The `bncert` tool will issue certificates only for domains that are currently directing traffic to the public IP address of your WordPress instance. + 6. For **Create an SSL/TLS certificate** , choose your domains and subdomains, enter an email address, select **I authorize Lightsail to configure a Let's Encrypt certificate on my instance** , and choose **Create certificate**. We start to configure the Lightsail resources. @@ -74,0 +72 @@ Add DNS records to the DNS of all domains that you want use with your WordPress +While setup is in progress, do not stop or make changes to your instance. It can take up to 15 minutes to configure your instance. You can view the progress for each step in the instance connect tab. @@ -75,0 +74 @@ Add DNS records to the DNS of all domains that you want use with your WordPress + 7. After the website setup is complete, verify that the URLs that you specified in the domain assignments step open your WordPress site. @@ -78 +76,0 @@ Add DNS records to the DNS of all domains that you want use with your WordPress -## Step 3: Connect to your instance @@ -80 +77,0 @@ Add DNS records to the DNS of all domains that you want use with your WordPress -Complete the following steps to connect to your instance using the browser-based SSH client in the Lightsail console. @@ -82 +79 @@ Complete the following steps to connect to your instance using the browser-based - 1. Sign in to the [Lightsail console](https://lightsail.aws.amazon.com/). +## Step 2: Get the admin password for your WordPress website @@ -84 +81 @@ Complete the following steps to connect to your instance using the browser-based - 2. In the left navigation pane, choose the SSH quick connect icon for your WordPress instance. +The default password to sign in to the administration dashboard of your WordPress website is stored on the instance. Complete the following steps to get the password. @@ -86 +83 @@ Complete the following steps to connect to your instance using the browser-based - +###### To get the default password for the WordPress administrator @@ -88 +85 @@ Complete the following steps to connect to your instance using the browser-based -The browser-based SSH client terminal window opens. You are successfully connected to your instance via SSH if you see the Bitnami logo as shown in the following example. + 1. Open the instance management page for your WordPress instance. @@ -90 +87 @@ The browser-based SSH client terminal window opens. You are successfully connect - + 2. On the **WordPress** panel, choose **Retrieve default password**. This expands **Access default password** at the bottom of the page. @@ -91,0 +89 @@ The browser-based SSH client terminal window opens. You are successfully connect + @@ -92,0 +91 @@ The browser-based SSH client terminal window opens. You are successfully connect + 3. Choose **Launch CloudShell**. This opens a panel at the bottom of the page. @@ -93,0 +93 @@ The browser-based SSH client terminal window opens. You are successfully connect + 4. Choose **Copy** and then paste the contents into the CloudShell window. You can either put your cursor at the CloudShell prompt and press Ctrl+V, or you can right-click to open the menu and then choose **Paste**. @@ -95 +95 @@ The browser-based SSH client terminal window opens. You are successfully connect -## Step 4: Confirm the bncert tool is installed on your instance + 5. Make a note of the password displayed in the CloudShell window. You need this to sign in to the administration dashboard of your WordPress website. @@ -97 +97 @@ The browser-based SSH client terminal window opens. You are successfully connect -Complete the following steps to ensure the Bitnami HTTPS configuration tool (`bncert`) is installed on your instance. It's not preinstalled on all _Certified by Bitnami_ WordPress instances when they're created. WordPress instances that were created on Lightsail a while back will require that you manually install the `bncert` tool. This procedure includes the steps to install the tool if it's is not installed. + @@ -99 +98,0 @@ Complete the following steps to ensure the Bitnami HTTPS configuration tool (`bn - 1. Enter the following command to run the `bncert` tool. @@ -101 +99,0 @@ Complete the following steps to ensure the Bitnami HTTPS configuration tool (`bn - sudo /opt/bitnami/bncert-tool @@ -103 +100,0 @@ Complete the following steps to ensure the Bitnami HTTPS configuration tool (`bn - * If you see `command not found` in the response as shown in the following example, then the `bncert` tool is not installed on your instance. Continue to the next step in this procedure to install the `bncert` tool on your instance. @@ -105 +102 @@ Complete the following steps to ensure the Bitnami HTTPS configuration tool (`bn -###### Important +## Step 3: Sign in to the administration dashboard of your WordPress website @@ -107 +104 @@ Complete the following steps to ensure the Bitnami HTTPS configuration tool (`bn -The `bncert` tool can only be used on WordPress instances that are _Certified by Bitnami_. Alternately, you can use the Certbot tool to enable HTTPS on your WordPress instance. For more information, see [Tutorial: Use Let’s Encrypt SSL certificates with your WordPress instance](./amazon-lightsail-using-lets-encrypt-certificates-with-wordpress.html). +Now that you have the password for the administration dashboard of your WordPress website, you can sign in. In the administration dashboard, you can change your user password, install plugins, change the theme of your website, and more. @@ -109 +106 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - +Complete the following steps to sign in to the administration dashboard of your WordPress website. @@ -111 +108 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - * If you see `Welcome to the Bitnami HTTPS configuration tool` in the response as shown in the following example, then the `bncert` tool is installed on your instance. Continue to the Step 5: Enable HTTPS on your WordPress instance section of this guide. +###### To sign in to the administration dashboard @@ -113 +110 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - + 1. Open the instance management page for your WordPress instance. @@ -115 +112 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - 2. Enter the following command to download the `bncert` run file to your instance. + 2. On the **WordPress** panel, choose **Access WordPress Admin**. @@ -117 +114 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - wget -O bncert-linux-x64.run https://downloads.bitnami.com/files/bncert/latest/bncert-linux-x64.run + 3. On the **Access your WordPress Admin Dashboard** panel, under **Use public IP address** , choose the link with this format: @@ -119 +116 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - 3. Enter the following command to create a directory for the `bncert` run file on your instance. +http://`public-ipv4-address`./wp-admin @@ -121 +118 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - sudo mkdir /opt/bitnami/bncert + 4. For **Username or Email Address** , enter `user`. @@ -123 +120 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - 4. Enter the following command to move the downloaded `bncert` run file to the new directory you created. + 5. For **Password** , enter the password obtained in the previous step. @@ -125 +122 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - sudo mv bncert-linux-x64.run /opt/bitnami/bncert/ + 6. Choose **Log in**. @@ -127 +124 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - 5. Enter the following command to make the `bncert` run a file that can be executed as a program. + @@ -129 +126 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - sudo chmod +x /opt/bitnami/bncert/bncert-linux-x64.run +You are now signed in to the administration dashboard of your WordPress website where you can perform administrative actions. For more information about administering your WordPress website, see the [WordPress Codex](https://codex.wordpress.org/) in the WordPress documentation. @@ -131 +128 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - 6. Enter the following command to create a symbolic link that runs the `bncert` tool when you enter the `sudo /opt/bitnami/bncert-tool` command. + @@ -133 +129,0 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by - sudo ln -s /opt/bitnami/bncert/bncert-linux-x64.run /opt/bitnami/bncert-tool @@ -135 +130,0 @@ The `bncert` tool can only be used on WordPress instances that are _Certified by -You are now done installing the `bncert` tool on your instance. Continue to the Step 5: Enable HTTPS on your WordPress instance section of this guide. @@ -137,0 +133 @@ You are now done installing the `bncert` tool on your instance. Continue to the +Bitnami @@ -140 +136 @@ You are now done installing the `bncert` tool on your instance. Continue to the -## Step 5: Enable HTTPS on your WordPress instance +## Step 1: Configure your WordPress instance @@ -142 +138 @@ You are now done installing the `bncert` tool on your instance. Continue to the -Complete the following procedure to enable HTTPS on your WordPress instance after you have confirmed that the `bncert` tool is installed on your instance. +You can configure your WordPress instance by using a guided, step-by-step workflow that will configure the following: @@ -144 +140 @@ Complete the following procedure to enable HTTPS on your WordPress instance afte - 1. Enter the following command to run the `bncert` tool. + * A registered domain name – Your WordPress site needs a domain name that is easy to remember. Users will specify this domain name to access your WordPress site. For more information, see [Register and manage domains for your website in Lightsail](./amazon-lightsail-domain-registration.html). @@ -146 +142 @@ Complete the following procedure to enable HTTPS on your WordPress instance afte - sudo /opt/bitnami/bncert-tool + * DNS management – You must decide how to manage the DNS records for your domain. A DNS record tells the DNS server which IP address or hostname a domain or subdomain is associated with. A DNS zone contains the DNS records for your domain. For more information, see [Understanding DNS in Lightsail](./understanding-dns-in-amazon-lightsail.html). @@ -148 +144 @@ Complete the following procedure to enable HTTPS on your WordPress instance afte -You should see a message similar to the following example. + * A Static IP address – The default public IP address for your WordPress instance changes if you stop and start your instance. When you attach a static IP address to your instance, it stays the same even if you stop and start your instance. For more information, see [View and manage IP addresses for Lightsail resources](./understanding-public-ip-and-private-ip-addresses-in-amazon-lightsail.html). @@ -150 +146 @@ You should see a message similar to the following example. - + * An SSL/TLS certificate – After you create a validated certificate and install it on your instance, you can enable HTTPS for your WordPress website so that traffic that is routed to the instance through your registered domain is encrypted using HTTPS. For more information, see [Secure your WordPress site with HTTPS on Lightsail](./amazon-lightsail-enabling-https-on-wordpress.html).