Setting Up and Renewing Let’s Encrypt HTTPS on Bitnami WordPress

2025-12-21

HTTPS keeps the connection between a visitor and a site encrypted. Once WordPress is serving logins, forms or public articles, the certificate and redirects become part of the experience everybody relies on. Google recommends HTTPS for site and user security.

The Bitnami WordPress image on Amazon Lightsail provides bncert-tool for setting up HTTPS with Let’s Encrypt.

Why the certificate has to renew

Let’s Encrypt is a publicly trusted certificate authority. It provides TLS certificates without charging for issuance, and its tools are designed to work with automated setup and renewal.

At the time of the original setup, the default Let’s Encrypt certificate lasted 90 days. Let’s Encrypt has announced a 64-day default from February 10, 2027, with shorter profiles available. Keep renewal automated and follow the current schedule rather than assuming every certificate lasts three months.

A certificate must be renewed before it expires. If renewal fails and nobody notices, browsers can stop trusting the connection even while the web server still runs.

What bncert sets up

Bitnami’s WordPress image packages the application with the components it needs, including a web server, PHP and a database. Lightsail also offers other blueprints, so make sure the instructions match the image you deployed.

bncert-tool can request a certificate, configure the web server and set up renewal. Check AWS’s instructions for your image before running it.

Start the setup tool

From an SSH session on the supported Bitnami image, start the tool with the command below.

  • Command: sudo /opt/bitnami/bncert-tool

The tool needs administrative privileges to update certificate files and the web server configuration. Review the hosts and redirects before confirming the changes.

Choose names and redirects

Enter the real hostnames you want covered, such as example.com and www.example.com. AWS’s bncert procedure expects those names to resolve directly to the public IP of the instance. A Lightsail static IP lets DNS keep pointing to the same place after a stop and start.

The tool asks whether to send HTTP visitors to HTTPS. Enable a redirect once the HTTPS host is ready. Then verify that it goes to the domain you intend to keep as the public address. The tool can apply the configuration and restart the web service.

Verify the live connection

Check the live site in a browser after setup or a renewal. Follow the normal route a reader takes, then open the WordPress sign-in separately.

  1. Open the HTTPS URL and check that the browser shows a valid certificate for that hostname.
  2. Try the HTTP URL and check that it reaches the intended HTTPS address without a loop.
  3. Open the WordPress login and look for insecure resources or blocked mixed content.

An older image or script link may still use HTTP. Check the WordPress home and site URLs and update hardcoded resource URLs if the page is loading them over an insecure connection.

Make renewal part of maintenance

Certificate management supports visitor trust and a working site every day. The setup tool is most valuable when the resulting renewal can happen unattended.

A small publication can make this work routine by letting the supported renewal job run and checking the expiry date from outside the server.

If the certificate is close to expiry, inspect the renewal log and confirm DNS and domain validation still work. Rerun setup only when the configuration calls for it. The point is to know the automatic job can still do what it did on the day you set it up.

Search stories