AWS – SES e-mail bucket – Part 3 – SES Identity, DNS, SSL

Once again, the following should be under your belt buckle as related to your website. Yes, it is a lot, but it becomes stock standard at some point.

Attend to SSL and DNS Records

Keep in mind, we are creating a website that requires an email component as part of the service. The website will need an SSL certificate.

This requires a DNS  CAA record. If the domain name registrar who holds your domain does not give you free access to editing CAA records, you should transfer to another registrar who does, such as Amazon Route53. The alternative is to see if the registrar has a paid DNS management option, which I never subscribe to paying.

Domain name transfers can be easy or complicated depending on who holds the registration. Normally, we access the domain records and unlock the domain so it can be transferred. Then we find the transfer key and copy it to an editor on our PC so we do not lose it. The key can go by various names, but it is a password in effect. Then we go to the provider who we want to transfer to, as they provide the free CAA record editing. We work out where they transfer a domain, and request the transfer using that key. The new provider should check the domain can be transferred due to it being unlocked and having the key. There should be no fee to transfer to an “ethical” registrar. You must have the original email address you used with the domain name on the current registrar, so they can send you an email to confirm the transfer. (This is tricky if you no longer have the email. The original provider may offer an internal mechanism to verify the transfer. I was once successful in transferring without the original email.)

Your registered email must be correct as now and then the authority that issues domain names may send you an email. If that email bounces, you could lose the domain. You never should respond to marketing emails not sent from the registrar that tell you the domain is about to expire.

Once verified, the transfer can be immediate, or a few days. There are various options when transferring. I usually ask to use the new provider’s NS Name Servers.  If you already have a website using the first provider, of course you have to backup the database and files first, and cut and paste helpful existing DNS records to your PC, such as records that point to MS Exchange.

When you have the EC2 Linux instance ready to hold the domain’s website, you would change the A record to point to the instance. If the domain DNS records are not on Amazon Route53, you would still edit the records to use the Amazon’s IP4 address in your A record.

If unsure about transfers, talk to the new registrar, and think about what you are doing before executing. You can lose a domain if it is not unlocked, you do not have the password, you don’t have the registered email address, or if there is any other setting by the original registrar required. Some mistakes can be corrected, but some registrars charge a wild west outlaws’ fee to help. The transfer should not involve any fee, so if it does I myself would not use them. However, there is likely a fee to update the domain’s registration for another 12 months.

Once transferred, you should add your intended CAA records. If using Let’s Encrypt, use “letsencrypt.org”. If Comodo store sells you the certificate, you would first have your admin@mydomain.com working before requesting the certificate, or use their DNS validation option and place that record into your DNS records. Creating a paid certificate – I use the cheapest Positive DV certificates – you need to now how to create a .csr and .key file. This is a separate lesson. However, Comodo would use a CAA record of sectigo.com and digicert.com. You must not add letsencrypt.org to the same domain name if using a paid SSL certificate. If using the free Let’s Encrypt, you must not use sectigo.com etc. However, a subdomain could use the free one, and your primary domain a paid one. You cannot register a Comodo certificate until the correct CAA record is saved. If so, you fix it, and may have to call their support desk to unlock it.

I use my free login to CleanTalk to create and download a .csr and .key file.

The form fields are easy to create. Here is an example of an old website I once had – none of these records exit today. Note, we just use “IT” as the organisation. The organisation name is usually your registered business name, or your ABN non-registered name, or failing that, just use your name.

 

Certificate covers:	photosbyshaw.com.au, www.photosbyshaw.com.au
Common name:	photosbyshaw.com.au
Email address:	shawlw@iinet.net.au
Organization name:	PHOTOSBYSHAW
Organization unit name:	IT
Country name:	AU
State or province:	Queensland
Locality name:	Brisbane

Once you have your paid certificate, in Linux2023 we store an edited version of the .crt file in /etc/pki/tls/certs and the .key file in /etc/pki/tls/private. If using Debian, we store these in /etc/ssl/certs and /etc/ssl/private.

Installing the free Let’s Encrypt is a separate lesson as it is fairly involved. Those keys will end up in /etc/letsencrypt/live/MYDOMAIN.COM/fullchain.pem and privkey.pem.

So, what is the edited .crt file from Comodo Store?

Comodo has a process to send you an email to admin@mydomain.com with a cryptographic-looking string you type into a URL link they take you to. You should have your CAA record in place first. Then they email you the .zip file with the certificate, or you can download it. I make a copy of the original .crt file, then edit the .crt file. I append to it the contents of SectigoRSADomainValidationSecureServerCA.crt, and append after that the contents of USERTrustRSAAAACA.crt. That is is. Then upload the .crt and the .key file you previously obtained to your Linux instance’s suitable directories. This order of appending is important. You can always use the same .csr and .key files when renewing certificates if you like. Comodo may ask if a new certificate is for use with Apache, which is fine even if using Nginx. A LiteSpeed package may come with what they call a bundled file. You just have to work out what contents to use. LiteSpeed is happy to append content. We never include what is called the root certificate. All this is about experience/learning.

When your website is up and running with https:// please check your certificate is correct with ssllabs.com for an A rating and no warnings about incorrect appending order that we made. We do not need to aspire to an A+ rating, but we can do that in the Nginx engine.

It is helpful to get these things done up front as much as possible before adding a website to an EC2 instance.

Your Static IP4 Address

Amazon AWS charges for use of a static IP4 address. Services using cPanel give a free shared address. Akamai/Linode at time of writing allocates a free static address. When allocating an address, go and check if it is blacklisted via mxtoolbox.com. On Akamia’s service I had to create a Linux “linode” nine times across two days before I got a good IP address. Victory! The static address is technically faster and has a better rating from various behind the scenes services. A shared address can be clobbered by another person with whatever they are doing, or become blacklisted. I feel serious business websites need the static address.