[ec2-user ~]cd /home/ec2-user
[ec2-user ~]$ sudo wget -r --no-parent -A 'epel-release-*.rpm' 

[ec2-user ~]$ sudo rpm -Uvh dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-*.rpm

sudo yum-config-manager --enable epel*

sudo yum install -y certbot 

sudo yum install -y python-certbot-nginx

sudo certbot certonly --standalone --debug -d your.domain

version: '3.5'
networks: 
  mynetwork:
    name: "MyNetWork"

services:
  my-server:
    image: nginx
    restart: always
    networks: 
      - mynetwork    
    ports:
      - "443:443"
    volumes:
      - ./my-server/nginx.conf:/etc/nginx/nginx.conf:ro

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;


    server {
            listen 443 ssl;
            server_name www.yourdomain.com;

            # 配置ssl
            ssl_certificate     /etc/letsencrypt/live/www.yourdomain.com/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/www.yourdomain.com/privkey.pem;

            # ssl验证相关配置
            # 不显式定义加密算法
            # 不建议显式定义，除非有需要额外定义的值，如果要显式定义加密算法，请另外搜索ssl_ciphers用法
            ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
            # 安全链接可选的加密协议
            ssl_protocols TLSv1.2 TLSv1.3;
            # 使用服务器端的首选算法
            ssl_prefer_server_ciphers on;
            
            # ssl 优化选项
            # 缓存有效期
            ssl_session_timeout  10m;
            # 配置共享会话缓存大小
            ssl_session_cache   shared:SSL:10m;
            
            rewrite  ^/$  /index.html  last;
            location / {
            }
    }
}

version: '3.5'
networks: 
  mynetwork:
    name: "MyNetWork"

services:
  my-server:
    image: nginx
    restart: always
    networks: 
      - mynetwork    
    ports:
      - "443:443"
    volumes:
      - ./my-server/nginx.conf:/etc/nginx/nginx.conf:ro
      - /etc/letsencrypt/live/www.yourdomain.com/fullchain.pem:/etc/letsencrypt/live/www.yourdomain.com/fullchain.pem
      - /etc/letsencrypt/live/www.yourdomain.com/privkey.pem:/etc/letsencrypt/livewww.yourdomain.com/privkey.pem