Deploying a Custom Domain on AWS Lightsail with Cloudflare DNS and SSL

Fully deployed, secured personal domain running on AWS Lightsail, with Cloudflare-managed DNS, email routing, and end-to-end HTTPS enforced at both the server and browser level. Gained hands-on experience with DNS record types, certificate authorities and the TLS handshake, and diagnosing infrastructure issues layer by layer rather than guessing at fixes.

Deploying a Custom Domain on AWS Lightsail with Cloudflare DNS and SSL

Objectives:

  • Deploy a personal portfolio site on AWS to build hands-on cloud infrastructure experience
  • Configure a custom domain, DNS, and HTTPS from scratch rather than relying on a fully managed host
  • Understand the full chain connecting a domain name to a working, secure website

Process:

  • Purchased matthewvallejos.com and set up an AWS Lightsail instance running WordPress on Debian Linux
  • Attached a static IP to the instance to prevent it from changing on reboot
  • Configured Cloudflare as the domain’s DNS provider, pointing nameservers away from the registrar’s default
  • Created an A record on the root domain pointing to the Lightsail static IP, and a CNAME record aliasing www to the root domain
  • Enabled Cloudflare’s proxy (orange cloud) on both records for DDoS protection and to hide the origin server’s IP
  • Set up Cloudflare Email Routing to forward a custom-domain email address to an existing inbox, and added SPF/DMARC records to protect the domain from spoofing
  • Generated a Cloudflare Origin CA certificate (ECDSA) and installed it on the server with SFTP and SSH to support Full Strict encryption between Cloudflare and the origin
  • Enabled “Always Use HTTPS” to force encrypted connections client-side and server-side

Debugging:

  • Initially attempted to use AWS Certificate Manager instead of Cloudflare’s certificate, but discovered ACM certificates aren’t installable directly on a standalone Lightsail instance without an Application Load Balancer — reverted to Cloudflare’s Origin CA certificate, which is directly installable and free
  • After installing the certificate, WordPress’s own site URL settings still pointed to HTTP in the database, which had to be corrected directly to avoid conflicting with Cloudflare’s proxy
  • The site loaded securely on desktop but defaulted to HTTP on mobile, traced to a missing “Always Use HTTPS” redirect rule rather than a certificate problem, since encryption and forced redirection are handled separately

Outcome:

Fully deployed, secured personal domain running on AWS Lightsail, with Cloudflare-managed DNS, email routing, and end-to-end HTTPS enforced at both the server and browser level. Gained hands-on experience with DNS record types, certificate authorities and the TLS handshake, and diagnosing infrastructure issues layer by layer rather than guessing at fixes.