Valid as of September 2020

Much of the current documentation on this from LetsEncryt and Godaddy suggests that this is a very hard thing to do - but I'm okay with spending 10 minutes every 2-3 months for a free, quality SSL certificate. If you are too, here's how I do it.

Here's my certbot command (replace mydomain.com and *.mydomain.com with your own):

certbot certonly --manual -d mydomain.com -d *.mydomain.com --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory

From the GoDaddy Admin site, navigate to your site's DNS management screen:

• Domain Manager (or Domains)
• mysite.com > [...] > Manage DNS
• Add

Host will be _acme-challenge (ie: the text record name WITHOUT the domain name part) and TXT Value will be whatever your certbot command prompted. This will have to be done twice if you're using a wildcard like me, since that counts as two domains. TTL can be very short since it's only a one-time thing.

Within Godaddy site, navigatate to CPanel SSL/TLS screen:

• My Hosting (alias Hosting & Wordpress, ...and others)
• [Site Name] > [...] > Settings
• File Manager
• CPanel Home
• SSL/TLS
• Click Manage SSL sites.

Certificate: (CRT) will be the first section of fullchain.pem that certbot generated, including the BEGIN and END lines.

Private Key (KEY) will be the entire file named privkey.pem that certbot generated.

Certificate Authority Bundle: (CABUNDLE) will be the second section of fullchain.pem that certbot generated, including the BEGIN and END lines.

Click Install Certificate and you're done!