[Updated 11/17 to reflect deprecation of Let’s Encrypt Mac OSX client.]
Thanks to Let’s Encrypt, free, reliable SSL certificates are now widely available. And while some hosting companies (like Dreamhost) have made the process of installing and renewing Let’s Encrypt certificates point-and-click simple, others <cough>GoDaddy</cough> aren’t quite so forward-thinking, so one has to get one’s hands dirty.
(In fairness, one can install the Let’s Encrypt client on their VPS and cloud servers, if that’s what you have. If instead you have the ever-popular shared cPanel hosting, this post’s for you.)
Before you begin, you’ll need:
- SSH access to the GoDaddy account enabled and, ideally, secured with a public / private key
- Certbot (and all dependencies) installed locally
Generating the certificate
- Initiate certbot:
sudo certbot certonly --manual
- Enter the root password when prompted.
- Enter the domain(s) when prompted:
Please enter in your domain name(s) (comma and/or space separated) (Enter 'c' to cancel):
If the site has an htaccess redirect from www to non-www (or vice versa) only include the non-redirected domain configuration. If, for example, our site is being redirected from www to non-www, only enter the non-www version of the domain.
Generating the certificate with both www and non-www versions of the domain included where only one is supported will cause the certificate to fail on verification.
- When prompted, type Y to accept having your IP address logged with the certificate request. (Assuming you are. If you aren’t, fire up your VPN and Tor and restart the process.)
- Cerbot will return a block of text like this (specific data replaced with [description]):
------------------------------------------------------------------------------- Create a file containing just this data: [filename].[key] And make it available on your web server at this URL: http://[domain]/.well-known/acme-challenge/[filename] ------------------------------------------------------------------------------- Press Enter to Continue
- In a second Terminal window, SSH to the remote host and navigate to the root web directory for this domain. If the domain being secured is the primary domain being hosted, this would be
- Create the necessary directories:
mkdir -p .well-known/acme-challenge
- Create the challenge file and write the data to it:
printf "%s" [filename].[key] > .well-known/acme-challenge/[filename]
- Change permissions of the generated file:
chmod -R 0644 .well-known
- Back in the first Terminal window, press ENTER. You should receive a success message:
IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at /etc/letsencrypt/live/[domain]/fullchain.pem.
If you don’t, see Troubleshooting below.
Installing the certificate
Now that the certificate have been successfully generated, it’s time to install them.
- In the first Terminal window, open
fullchain.pemin an editor:
sudo vi /etc/letsencrypt/live/[domain]/fullchain.pem
- The file will contain 2 certificates, each starting with
-----BEGIN CERTIFICATE-----and ending with
-----END CERTIFICATE-----. Copy the entirety of the first certificate, including the
-----END CERTIFICATE-----tags, then exit the editor.
- Log into your GoDaddy account, then click through to the cPanel (click the + next to Web Hosting, then click the green MANAGE button for the domain you’re securing).
- Scroll down to “Security” and click “SSL/TSL”.
- Under “Install and Manage SSL for your site (HTTPS)” click the “Manage SSL sites.” link.
- Under “Install an SSL Website”, select the (sub)domain you are securing, then paste the certificate text into the “Certificate: (CRT)” textarea. Look for the green checkmark to the right of the textarea.
- In the first Terminal window, open
privkey.pemin an editor:
sudo vi /etc/letsencrypt/live/[domain]/privkey.pem
- Copy the entire contents of the file, then exit the editor.
- Paste the key text into the “Private Key (KEY)” textarea. Look for the green checkmark to the right of the textarea.
- Click the green “Install Certificate” button. All going well you should see a success message.
- If this is the primary domain, click the “Make Primary” link in the right column of the “Manage Installed SSL Websites” for the domain.
- Test the SSL to confirm everything’s properly set up.
Let’s Encrypt certificates are only valid for 90 days. You’ll receive an automated reminder to renew the certificates 2 weeks, 1 week, and 1 day from the expiration date.
Try loading the test URL in a browser window, as provided in the initial output:
Make sure your web server displays the following content at http://[domain]/.well-known/acme-challenge/[filename] before continuing
Another way of testing for this file is by using
wget from the command-line, in a terminal window:
I prefer this method as you can view the actual response from the server, instead of merely being show your site’s 404 error page.
Assuming you’ve received a 404 error, here are some possible causes:
- The file isn’t there
Confirm this by navigating to
~/public_html/.well-known/acme-challenge/and looking for the appropriately-named file. If not found, run the
- The file or containing directory has been created with excessively-restrictive permissions
Reset permissions (recursively) via the command-line:
chmod -R 0644 ~/public_html/.well-known/
- Interference from rewrite rules
If you have rewrite rules in your
.htaccessfile that redirect HTTP to HTTPS or restrict direct access to files and folders starting with a dot, either (or both) of these will result in a 404 error. Comment out the rules you think might be causing a problem one-by-one, running the
wgetcommand after each. Don’t forget to uncomment any rules after you’ve verified the file and generated your keys.