goddady said they do not offer support for letsencrypt so i must as i understood install certbot, but it not clear for me how to do so in the documentation as the documentation talks about the commands
So it's using a webbased, very manual approach. Two things:
This manual approach is not recommended, but GoDaddy makes it very hard to automate things;
The tutorial speaks about two certificates being present in the "certificate output" of PunchSalad where it currently should have three certificates in the output! So the copy/paste part of the "second" certificate should probably be "second and third" certificate.
As I said, this manual approach is not recommended. It's also very cumbersome. @griffin, a fellow volunteer on this Community, has written an ACME client completely written in PHP which can be used on your GoDaddy server and also issue a certificate! While it still contains manual parts (it should be possible to automate this on GoDaddy though, however, there are just 24 hours in a day and time is sparse, so it hasn't been developed yet..), it is much easier to work with compared to using PunchSalad. You can find the mentioned client CertSage here:
I read in some thread here in the letsencrypt community forum, that it is possible to get shell access to godaddy server. With shell access you can freely select the ACME client to automatize the certificate issuance.
As the resident GoDaddy guy, I can say that GoDaddy has some peculiarities that I designed CertSage to cleanly handle. If you're using cPanel shared hosting, you can access a terminal through cPanel, which only appears in the Advanced section when you enable SSH. However, without root access, which you don't have, the large majority of ACME clients won't work. CertSage does not require root access.
Generally, you should avoid third-party, website-based ACME clients like an infectious disease unless you feel like auditing thousands of lines of Javascript to be sure your keys aren't being leaked. They also require extra, manual steps, which is completely ridiculous and unnecessary. With CertSage you won't ever need to manually create TXT records or verification files. The software handles that for you, like it's supposed to.
Not sure honestly. They handle the CA bundle fillin by themselves. I'll have to test. I always paste all three certs returned by Boulder into the certificate box, but they seem to ignore the last two. I think I'll test overriding their automatic fillin of the CA cert with the two intermediates.
thanks griffin for sharing ! I'll test it out ! so it would eliminate the problem of not safe on mobile if i installed the certificate through your script ?
CertSage is a first-party ACME client, which means that all sensitive materials, such as your ACME account and certificate private keys, are generated directly on your webserver by the client. Moreover, unauthorized parties are prevented from using CertSage on your behalf by a 96-bit random code that changes every time CertSage is run. Only someone with access to CertSage's data folder (where your ACME account keys, certificate key, and certificate are saved) can retrieve that code.
CertSage is also the simplest way to get your certificate when using GoDaddy shared hosting. You can have your certificate within minutes of downloading CertSage using your favorite web browser on your smartphone. I'm not joking when I say that I've renewed and installed a certificate using my smartphone while waiting for a latte at Starbucks.
yes i have tried it, it is great but there is a small issue, i did it first time for my main domain in the public_html, then i decided to delete it again and insert another domain inside the main domain, not a subdomain but a domain. So i tried it again and it gave me authorized failed nevertheless i have deleted all certificates and all code.txt and responses and started over. So what should i do ?
The web server for the domain f1ian.com is still serving the short chain without the intermediate certificate "ISRG Root X1" signed by "DST Root CA X3". Have you got the proper certificate chain? Did you apply that to the web server?
It is very common with GoDaddy to have webroot directories for other domain names inside of public_html. You need to put a copy of certsage.php inside of the webroot directory for the other domain name as well. For example, let's say you have anotherdomain.com and its webroot directory is public_html/anotherdomain. You would put a copy of certsage.php in public_html/anotherdomain then modify line 16 of that certsage.php from this:
$dataDirectory = "../CertSage";
to this:
$dataDirectory = "../../CertSage";
That way CertSage will look two levels up for its data directory instead of one level up as the default. You would then visit anotherdomain.com/certsage.php and proceed in the usual way. Note that once you acquire a certificate for any domain name, you should install it before proceeding to acquire a certificate for a different domain name since CertSage will overwrite the certificate.crt and certificate.key in its data directory each time it acquires a certificate for you.
