# Deploying Certbot in AWS Lambda

**URL:** <https://community.letsencrypt.org/t/deploying-certbot-in-aws-lambda/51797>\
**Category:** Server\
**Created:** [January 31, 2018, 4:51am UTC](https://community.letsencrypt.org/t/deploying-certbot-in-aws-lambda/51797 "2018-01-31T04:51:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![arkadiyt](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@arkadiyt](https://community.letsencrypt.org/u/arkadiyt)\
**Post date:** [January 31, 2018, 4:51am UTC](https://community.letsencrypt.org/t/deploying-certbot-in-aws-lambda/51797/1 "2018-01-31T04:51:33Z")

</div>

Hi all,

I just published a blog post about the steps necessary to deploy Certbot inside AWS Lambda and thought I would share here as well:

> **[Deploying EFF's Certbot in AWS Lambda](https://arkadiyt.com/2018/01/26/deploying-effs-certbot-in-aws-lambda/)**
>
> Deploying EFF's Certbot inside AWS Lambda for automated certificate renewal

For fully serverless websites it’s the only way to have automatically renewed certificates, and even for regular website setups I think it’s a very appealing option for all the usual serverless benefits - low/no maintenance.

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [January 31, 2018, 10:17am UTC](https://community.letsencrypt.org/t/deploying-certbot-in-aws-lambda/51797/2 "2018-01-31T10:17:11Z")

</div>

Pretty cool, I love uses of serverless for things like this.

It could also be generalized for central distribution of certificates, e.g. uploading them into S3 and allowing downstream services to just download them on a schedule.

Is there any particular motivation for wanting to import Let’s Encrypt certificates into ACM, rather than relying on the the free, long duration and automatically renewing DV certificates built into ACM?

---

<div class="post-metadata">

**Author:** ![arkadiyt](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@arkadiyt](https://community.letsencrypt.org/u/arkadiyt)\
**Post date:** [January 31, 2018, 6:22pm UTC](https://community.letsencrypt.org/t/deploying-certbot-in-aws-lambda/51797/3 "2018-01-31T18:22:19Z")

</div>

Does ACM support that? When I originally tried it it only supported email verification.

If it does support it now then that would also be a perfectly valid approach, although I’m very fond of LetsEncrypt and how it’s pushed the industry, so I’d still prefer to use it.

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [January 31, 2018, 6:34pm UTC](https://community.letsencrypt.org/t/deploying-certbot-in-aws-lambda/51797/4 "2018-01-31T18:34:21Z")

</div>

> [@arkadiyt](#):
>
> Does ACM support that? When I originally tried it it only supported email verification.

ACM supports magic DNS validation now. You set a `CNAME` record with a special name and value, they'll issue the certificate, and automatically renew (as long as it's in use).

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [March 2, 2018, 6:34pm UTC](https://community.letsencrypt.org/t/deploying-certbot-in-aws-lambda/51797/5 "2018-03-02T18:34:48Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.