> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/aws/enable-https.md).

# enable-https

Put a real Let's Encrypt wildcard certificate on a bastion and make its nginx terminate TLS.

## Syntax

```bash
rumi cloud aws enable-https \
  --profile <profile> \
  --network <network> \
  --key-pair <keypair> \
  --domain <domain> \
  [options]
```

## Options

| Option       | Short | Description                                                                                                                                                                                                     | Default                            |
| ------------ | ----- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
| `--profile`  | `-p`  | AWS profile to use                                                                                                                                                                                              | Required                           |
| `--region`   | `-r`  | AWS region                                                                                                                                                                                                      | `us-east-1`                        |
| `--network`  | `-n`  | Name of the network                                                                                                                                                                                             | Required                           |
| `--key-pair` | `-k`  | The network key pair                                                                                                                                                                                            | Required                           |
| `--name`     | `-b`  | The bastion name to enable HTTPS on; omit for the single (unnamed) bastion                                                                                                                                      | none                               |
| `--domain`   | `-d`  | The base domain to secure; the wildcard cert covers `<domain>` and `*.<domain>`                                                                                                                                 | Required                           |
| `--email`    | `-m`  | Let's Encrypt account email for expiry notices                                                                                                                                                                  | none (registered without an email) |
| `--force`    | `-f`  | Re-point a bastion already secured for a DIFFERENT domain; the shared cert is re-issued under `<domain>`, so any service already proxied under the old domain must be re-launched to re-proxy under the new one | `false`                            |

## Example

```bash
rumi cloud aws enable-https \
  --profile my-aws-profile \
  --network my-network \
  --key-pair my-keypair \
  --domain example.com \
  --email ops@example.com
```

## Notes

This obtains a Let's Encrypt wildcard cert via DNS-01 / Route53 and makes the bastion's nginx terminate TLS.

Run it right after `launch-bastion` and BEFORE launching services, so each proxy is created as a TLS block.

A bastion secures exactly one domain. Re-running with the same domain is an idempotent renew; switching domains needs `--force`.

The bastion must carry an instance profile granting Route53 access, so launch it with `-I`.

## See Also

* [launch-bastion](/rumi-cli/commands/cloud/aws/launch-bastion.md)