Let's Encrypt your Elastic Beanstalk single instance!

.ebextension-lets-encrypt.yaml

Resources:
  sslSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0
      
packages:
  yum:
    mod24_ssl : []

files:
  /etc/httpd/conf.d/ssl.conf:
    mode: "000644"
    owner: root
    group: root
    content: |
      LoadModule ssl_module modules/mod_ssl.so
      Listen 443
      <VirtualHost *:443>
        <Proxy *>
          Order deny,allow
          Allow from all
        </Proxy>

        SSLEngine             on
        SSLCertificateFile    /etc/letsencrypt/live/ebcert/cert.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/ebcert/privkey.pem
        SSLCertificateChainFile /etc/letsencrypt/live/ebcert/chain.pem
        SSLCipherSuite        EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
        SSLProtocol           All -SSLv2 -SSLv3
        SSLHonorCipherOrder   On
        SSLSessionTickets     Off

        Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
        Header always set X-Frame-Options DENY
        Header always set X-Content-Type-Options nosniff

        ProxyPass / http://localhost:80/ retry=0
        ProxyPassReverse / http://localhost:80/
        ProxyPreserveHost on
        #RequestHeader set X-Forwarded-Proto "https" early

      </VirtualHost>
      
container_commands:
  10_stop_httpd:
    command: "sudo service httpd stop"
  20_install_certbot:
    command: "wget https://dl.eff.org/certbot-auto;chmod a+x certbot-auto"
  30_get_cert:
    command: "sudo ./certbot-auto certonly --non-interactive --email ${certemail} --agree-tos --standalone --domains ${certdomain} --keep-until-expiring"
  40_link:
    command: "sudo ln -sf /etc/letsencrypt/live/${certdomain} /etc/letsencrypt/live/ebcert"
  40_start_httpd:
    command: "sudo service httpd start"

Thanks for this!
For someone trying it on Amazon Linux:
FATAL: Amazon Linux support is very experimental at present...
Then simply add --debug flag to the command in 30_get_cert step.

Yeah, @csoni111 the primary error is because is necessarily allow 443 port.

Change:

CidrIp: 0.0.0.0/0

to:

SourceSecurityGroupName: {"Fn::GetAtt" : ["AWSEBLoadBalancer" , "SourceSecurityGroup.GroupName"]}

See more information: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-elb.html

Second, I also have this problem and I tried to solve but no success yet.

Traceback (most recent call last):
  File "/opt/eff.org/certbot/venv/bin/letsencrypt", line 11, in <module>
  sys.exit(main())

  File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/main.py", line 861, in main
  return config.func(config, plugins)

  File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/main.py", line 786, in certonly
  lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)

  File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/main.py", line 85, in _get_and_save_cert

How do you set certemail and certdomain variable in yaml file ?

Hi, does this configuration works also in Windows server?