[Updated 11/17 to reflect deprecation of Let’s Encrypt Mac OSX client.]
The only downside is that they’re good for just 90 days (they do have their reasons) so renewal is a process one will get used to pretty quickly.
Before you begin, you’ll need:
- SSH access to the GoDaddy account enabled and, ideally, secured with a public / private key
- Certbot (and all dependencies) installed locally
Generating the certificates
- Initiate certbot:
sudo certbot certonly --manual
- Enter the root password when prompted.
- Enter the domain(s) when prompted:
Please enter in your domain name(s) (comma and/or space separated) (Enter 'c' to cancel):
If the site has an htaccess redirect from www to non-www (or vice versa) only include the non-redirected domain configuration. If, for example, our site is being redirected from www to non-www, only enter the non-www version of the domain.
If you generate the certificate with both www and non-www versions of the domain included where only one is supported, the certificate will fail on verification.
- When prompted, type Y to accept having your IP address logged with the certificate request. (Assuming you are. If you aren’t, fire up your VPN and Tor and restart the process.)
- Cerbot will return a block of text like this (specific data replaced with [description]):
------------------------------------------------------ Create a file containing just this data: [filename].[key] And make it available on your web server at this URL: http://[domain]/.well-known/acme-challenge/[filename] ------------------------------------------------------- Press Enter to Continue
- In a second Terminal window, SSH to the remote host and navigate to the root web directory for this domain. If the domain being secured is the primary domain being hosted, this would be
- Create the necessary directories:
mkdir -p .well-known/acme-challenge
- Create the challenge file and write the data to it:
printf "%s" [filename].[key] > .well-known/acme-challenge/[filename]
- Change permissions of the generated file:
chmod -R 0644 .well-known
- Back in the first Terminal window, press ENTER. You should receive a success message:
IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at /etc/letsencrypt/live/[domain]/fullchain.pem. Your key file has been saved at: /etc/letsencrypt/live/[domain]/privkey.pem Your cert will expire on [YYYY-MM-DD]. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew"
If you don’t, see Troubleshooting below.
Updating the certificates
Now that the certificates have been successfully generated, it’s time to update them on the site.
- Log into your GoDaddy account, then click through to the cPanel (click the + next to Web Hosting, then click the green MANAGE button for the domain you’re securing).
- Scroll down to “Security” and click “SSL/TLS”.
- Under “Install and Manage SSL for your site (HTTPS)” click the “Manage SSL sites.” link.
- Scroll down to the domain you’re securing, then click the “Update Certificate” link in the “Actions” column on the right.
- Back in the first Terminal window, open
fullchain.pemin an editor:
sudo cat /etc/letsencrypt/live/[domain]/fullchain.pem
- The file will contain 2 certificates, each starting with
-----BEGIN CERTIFICATE-----and ending with
-----END CERTIFICATE-----. Copy the entirety of the first certificate, including the
-----END CERTIFICATE-----tags, then exit the editor.
- Paste the certificate text into the “Certificate: (CRT)” textarea. A green checkmark should appear to the right of the textarea, as well as a green “Autofill by Certificate” button.
- Click the green “Autofill by Certificate” button. This should autofill the Certificate Authority Bundle in the third textarea. If not, cut and paste the second certificate from your Terminal window into the third textarea.
- Back in the first Terminal window, close
privkey.pemin an editor:
sudo cat /etc/letsencrypt/live/[domain]/privkey.pem
- Copy the entire contents of the file, then exit the editor.
- Paste the text into the “Private Key (KEY)” textarea. A green checkmark should appear to the right of the textarea.
- Scroll down to the bottom of the page and click the green “Install Certificate” button. All going well you should see a success message.
- Test the SSL to confirm everything’s properly set up.
A final, optional step is to return to the SSL Manager, then click “Certificates (CRT)”. This will load an overview of all certificates installed for this domain. Click the “Delete” link in the “Actions” column (far right) for any expired or soon-to-expire certificates.
Try loading the test URL in a browser, as provided in the initial output:
Another way of testing for this file is by using
wget from the command-line, in a terminal window:
I prefer this method as you can view the actual response from the server, instead of just your site’s 404 error page.
Assuming you receive a 404 error, here are some possible causes:
- The file isn’t there
Confirm this by navigating to
~/public_html/.well-known/acme-challenge/and looking for the appropriately-named file. If not found, run the
- The file or containing directory has been created with excessively-restrictive permissions
Reset permissions (recursively) via the command-line:
chmod -R 0644 ~/public_html/.well-known/
- Interference from rewrite rules
If you have rewrite rules in your
.htaccessfile that might affect viewing that file — such as redirecting from HTTP to HTTPS or preventing access to files and folders starting with a dot — comment out those rules one by one, running the
wgetcommand after each, until the problem is solved. Don’t forget to uncomment any rules after you’ve verified the file and generated your keys.