GoDaddy ACME automation for every server you run

Running GoDaddy ACME on your own servers

The do-it-yourself version, once you have EAB credentials:

1. Give each client write access to your DNS. This is where GoDaddy differs from the enterprise CAs. The domain is usually in the same account as the certificate, so the obvious path is a GoDaddy DNS API key on the web server for DNS-01 challenges. That is a credential that can rewrite your zone, sitting on a box whose job is serving public traffic.
2. Register each client against your GoDaddy account. The EAB Key ID and HMAC go into a config file per machine. If the GoDaddy login is shared across a team or an agency, those credentials now live in several places at once.
3. Write the post-deploy hook for each platform. Certificates arrive as files; a working site needs them converted, moved, referenced in the vhost or binding, and the service reloaded. On a control panel host, that step may only be possible through the panel's own UI, which a hook cannot drive.
4. Cover whatever isn't a web server. A mail server, a router, or an appliance in the same estate takes its certificate a different way entirely, and none of them run certbot.
5. Monitor from outside the box. A renewal timer that silently stopped looks identical to one that is working, right up until the browser warning. Checking the live endpoint is the only reliable signal.
6. Keep a record of what is installed where. Which certificate is on which host, and when it last changed. That lives in per-host logs that rotate away, or nowhere.

The gap here is organizational as much as technical: the certificate lives in a billing account, the ACME client lives on a server someone else operates, and nothing joins them. As 47-day certificates arrive by 2029 that join has to happen roughly twelve times a year.

47-day lifetimes turn that gap into a monthly problem. Here's how CertKit closes it.

Setup takes about ten minutes

1. Delegate validation with one CNAME. One record per domain. Every renewal after that validates against it, wherever your DNS is hosted.
2. Get your EAB credentials from GoDaddy. Sign in, open SSL Certificates › Manage All, then choose ACME Automation › ACME Setup to generate the Key ID and HMAC.
3. Add GoDaddy as an issuer in CertKit. Friendly name, account email, EAB Key ID, and HMAC. The issuer becomes available to every collection once it validates.
4. Install the CertKit Agent and pick a template. One command on each server, then choose the deployment template for that platform.

See the issuer documentation →

Why not just let the registrar handle it?

Registrar-bundled certificates are convenient because everything is in one bill and domain validation is automatic when the DNS is in the same account. That convenience is real, and it is also the whole of the offer. It ends at the point where the certificate has to be installed on infrastructure the registrar has no access to.

The awkward consequence is organizational rather than technical. The certificate is attached to a billing account, often owned by whoever registered the domain years ago, while the expiry consequences land on whoever operates the server. Renewal notices go to the first person and outages happen to the second.

CertKit puts the certificate under the same automation as everything else you run, regardless of who bought it or where. Keep purchasing through GoDaddy if the pricing suits you; the renewal and the install stop being manual either way.