- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
GoDaddy
GoDaddy sells SSL/TLS certificates under two different product models, and CertSecure Manager has one connector for each. Both are configured from the same GoDaddy tile under Administration > Certificate Authorities, and both use the same GoDaddy API key, API secret and Customer #.
Product Models
| Product Model | What the account holds | How certificates are issued |
|---|---|---|
| GoDaddy SSL (Credits) | Standard, Deluxe and Premium SSL products. Each purchased product becomes a credit, and each order consumes one credit. | CertSecure Manager places an order with the GoDaddy Certificates API. Domain control is proved for each order. |
| GoDaddy Automated SSL | An Automated SSL subscription (90-day auto-reissuing certificates) with the domains attached. It grants no order credits. | CertSecure Manager issues over ACME with External Account Binding. It reads the binding from your GoDaddy account, so no key has to be copied by hand. |
Note: The two models are not interchangeable. An account that holds only an Automated SSL subscription is fully entitled, but the credit ordering API refuses its orders with "You do not have an available product" however many subscriptions are bought. If CertSecure Manager detects that the account can issue over ACME, the error tells you to register the account as GoDaddy Automated SSL instead. Select the product model that matches what your account holds.
Note: GoDaddy and GoDaddy Automated SSL use a single license entry. A license that includes GoDaddy covers both product models.
Prerequisites
- A GoDaddy API key and secret for the environment you will use. Production and the OTE (test) environment take different keys.
- The Customer # shown in your GoDaddy account menu. A customer ID (UUID) is also accepted if you already have one.
- For GoDaddy SSL (Credits): at least one available credit of the product you will order.
- For GoDaddy Automated SSL: an active Automated SSL subscription.
- For domain validation: the DNS zone of each domain must be one that CertSecure Manager can write to. This is the case for a zone hosted in the same GoDaddy account, and for a domain added under Utilities > ACME > Domain with the credentials of its DNS provider.
- A role with the Manage Certification Authorities permission.
Adding a GoDaddy CA
- Go to Administration > Certificate Authorities, find the GoDaddy tile in the Agentless CAs section and select Configure. Select Add New Connection on the page that opens. The Configure GoDaddy CA dialog opens.
- Complete the connection details:
| Field | Required | Description |
|---|---|---|
| Product Model | Yes | GoDaddy SSL (Credits) or GoDaddy Automated SSL. It cannot be changed after the CA is saved, because it decides which connector the CA is and certificates it already issued would be left on a CA that could no longer collect or revoke them. |
| Name | Yes | The name of the CA in CertSecure Manager. |
| Description | No | A free-text description. |
| Environment | Yes | Production or OTE (Test). OTE and production take different API keys, so select the one your credentials belong to. |
| API Key | Yes | The GoDaddy API key. |
| API Secret | Yes | The GoDaddy API secret. When you edit a CA, leave it blank to keep the stored secret. |
| Customer # | Yes | Your GoDaddy customer number. CertSecure Manager resolves it to the customer ID the API needs. |
- Under Default Certificate Template, select Test credentials & read account. The button is available once API Key, API Secret and Customer # are filled. CertSecure Manager contacts GoDaddy with these values. For GoDaddy SSL (Credits) it loads the products of the account. For GoDaddy Automated SSL it reads the account's External Account Binding.
- Complete the template fields that appear (see Default Certificate Template) and select Submit.
Note: If you change the Product Model after testing the credentials, the template fields are cleared and you must test the credentials again, because the two models offer different template options.
Default Certificate Template
Every CA is registered with a default certificate template. The template has the same fields as a template created under Certificate Templates and can be changed there later.
GoDaddy SSL (Credits) templates offer:
| Field | Description |
|---|---|
| Product Type | The GoDaddy product ordered for each request. See the table below. |
| Root Type | The chain the certificate is signed under: GoDaddy SHA-2 or Starfield SHA-2. The default is GoDaddy SHA-2. |
| Order Contact | The contact GoDaddy requires on every order. An email address is mandatory; first name, last name, phone and job title are optional. A contact supplied on a request overrides the template, and the template overrides the CA. |
| Organization | The organization block of the order. Required for Organization Validated (OV) and Extended Validation (EV) products and ignored for Domain Validated (DV) products. |
| Validity | Ordered in whole years. A value in days is rounded up to the next whole year. |
| Product Type | Description | Order period (years) | Organization required |
|---|---|---|---|
DV_SSL |
Domain Validated SSL (single domain) | 1, 2, 3 | No |
DV_WILDCARD_SSL |
Domain Validated Wildcard SSL | 1, 2, 3 | No |
UCC_DV_SSL |
Domain Validated Multi-Domain (UCC/SAN) SSL | 1, 2, 3 | No |
OV_SSL |
Organization Validated SSL (single domain) | 1, 2, 3 | Yes |
OV_WILDCARD_SSL |
Organization Validated Wildcard SSL | 1, 2, 3 | Yes |
OV_SAN_SSL |
Organization Validated Multi-Domain (SAN) SSL | 1, 2, 3 | Yes |
UCC_OV_SSL |
Organization Validated Multi-Domain (UCC) SSL | 1, 2, 3 | Yes |
EV_SSL |
Extended Validation SSL (single domain) | 1, 2 | Yes |
UCC_EV_SSL |
Extended Validation Multi-Domain (UCC) SSL | 1, 2 | Yes |
GoDaddy Automated SSL templates have no product, root type or order contact, because ACME has no product catalogue. They offer key material, signing algorithm, validity and the common name only. ACME does not allow a lifetime to be requested, so the validity is fixed by GoDaddy.
Note: For GoDaddy SSL (Credits), GoDaddy sets the key usages (digital signature and key encipherment), the extended key usages (server authentication and client authentication) and the organization, country, state and locality of the subject from the validated account record. A template cannot choose them. Subject Alternative Names are DNS names only (up to 100); IP address, email and URI names are not supported. Keys can be RSA or EC, signed with SHA-256 or SHA-384.
Note: A certificate request always includes the common name as a DNS Subject Alternative Name, as public CAs require.
GoDaddy Connections
The GoDaddy page lists the configured connections in two sections, one for each product model. Select Refresh to reload the list, and use the search box and the column filters to find a connection. View Decommissioned Connections shows connections that have been decommissioned.
GoDaddy SSL (Credits) columns:
| Column | Description |
|---|---|
| Connection ID | The identifier of the connection in CertSecure Manager. |
| Certification Authority | The name given to the CA. |
| API Key | The GoDaddy API key, as stored. |
| Credential | Whether GoDaddy still accepts the stored key: Configured, Expired, Unverified or Not set. See Certificate Authorities. |
| Customer # | The GoDaddy customer number. |
| Product | The product type of the default template. |
| Sync | The state of the last inventory synchronization. |
| Status | Enabled, Disabled or Decommissioned. |
| Last Successful Sync | When the inventory was last synchronized successfully. |
GoDaddy Automated SSL columns: Connection ID, Certification Authority, Customer #, ACME Account, Credential and Status. ACME Account reads Registered once CertSecure Manager has created its account with GoDaddy, and Not registered before that. The account is created when the first certificate is issued; adding the CA only checks that the GoDaddy ACME directory can be reached. The ACME account key is stored encrypted in the CertSecure Manager database, so any backend node can issue with it.
Right-click a connection for these actions: View Details, Check Credential, Edit, Decommission, and, for a decommissioned connection, Restore. Check Credential tests the stored key with GoDaddy immediately. Edit opens the Configure GoDaddy CA dialog with the title Edit followed by the name; the Product Model, the name and the connector cannot be changed, and Save Changes is available only after Test credentials has been run in the dialog. Decommission takes effect straight away, without a confirmation, and can take up to 15 minutes to complete. Restore opens the dialog again with the name carried over, and asks for the credentials again.
Issuing a Certificate
Certificates are requested from Enrollment like those of any other CA. GoDaddy-specific behaviour:
GoDaddy SSL (Credits)
- CertSecure Manager places the order with the product, root type, contact and organization of the template.
- GoDaddy no longer validates domain control by email. It expects a TXT record to be published and then a request to re-check it. CertSecure Manager does this for each domain on the order: it reads the validation token from the order, publishes a TXT record at the top of the domain's DNS zone, and asks GoDaddy to re-check. GoDaddy states that the check can take 5 to 10 minutes.
- The order is waiting for validation, so the certificate is usually not issued within the request. The task stays in the Processing state while the order is pending. CertSecure Manager collects the certificate by itself when GoDaddy issues it, for up to 35 days, and then installs it and updates the inventory. It does not place a second order.
- If GoDaddy cancels or refuses the order, for example because the validation code expired, or if no credit is available, the task fails with GoDaddy's reason and the request is marked Failed.
Note: If the DNS zone of a domain is not one CertSecure Manager can write to, no record is published and the order stays pending. Add the validation record by hand, or upload the validation file GoDaddy names, and then select Check my update in the GoDaddy SSL console. The records that CertSecure Manager publishes are left in the zone, because GoDaddy re-checks them asynchronously.
GoDaddy Automated SSL
- CertSecure Manager registers its ACME account with GoDaddy at the first request, using the External Account Binding read from your account.
- It creates the order, publishes the dns-01 challenge record through the DNS provider registered for the domain, waits for validation, and downloads the certificate.
- The challenge record is removed afterwards, whether the order succeeds or fails.
If a request fails, the cause that GoDaddy reported is shown on the task. Failed requests are not retried automatically. Re-run them from Utilities > Tasks once the cause is fixed.
Inventory
The inventory of both models is synchronized with GoDaddy's customer certificate listing, so certificates that were ordered outside CertSecure Manager appear in the inventory too. Each synchronized certificate is tagged with the CertSecure certificate template whose product matches it; if none or several match, the default template of the CA is used.
Note: Some GoDaddy accounts are not allowed to read the customer certificate listing even though the key works for ordering. For these accounts certificates can still be issued, but the inventory cannot be synchronized from GoDaddy, and the certificate counts shown for the CA come from the certificates CertSecure Manager itself holds.
Troubleshooting
| Symptom | Cause and action |
|---|---|
| The Credential column shows Expired | GoDaddy rejected the key or secret, or the Environment does not match the key (OTE and production keys are different). Edit the connection, enter the new values and run Test credentials & read account. |
| "You do not have an available product" | The account has no credit for the product. If the account holds an Automated SSL subscription, register it as GoDaddy Automated SSL. |
| The order stays pending | The domain validation record was not published or GoDaddy has not re-checked it yet. Check that the domain's DNS zone is registered under Utilities > ACME > Domain or hosted in the GoDaddy account, and wait for the re-check. |
| Test credentials & read account is disabled | API Key, API Secret and Customer # must all be filled in. |
| Test credentials & read account fails for GoDaddy Automated SSL | The External Account Binding could not be read from the account. Check that the API key can read the account's ACME binding and that the Automated SSL subscription is active. |