Menu
SMORTLER + SI / VIOLET FIELD GUIDE / SECURITY

Private servers.
Public trust.
GoDaddy DNS-01.

Let Violet guide the verification. Own the DNS challenge, issue a trusted certificate, and build a renewal process that can prove itself - without opening an inbound public web port.

Personalize the mission ↓
An interactive guide - your hostnames stay in your browser. Never enter secrets.
Violet, the original SI robot, guiding the certificate validation mission
VIOLET SECURITY MISSION / PRIVATE UBUNTU 24.04

Make DNS do the proving.

These instructions focus on new Let's Encrypt certificates for one or two private Ubuntu 24.04 servers using Apache and a third-party GoDaddy DNS plugin. Enter a short hostname, optional subdomain, and base domain once. Violet updates the resulting DNS challenge names, certificate paths and copyable server commands.

No GoDaddy API credentials are entered into this page. All examples are for demonstration. Installing software or issuing certificates changes your server or DNS account, so read the cautions before executing a command.

01 / OWNERGoDaddy DNS
02 / PROOFTemporary TXT
03 / ISSUERLet's Encrypt
04 / RESULTPrivate HTTPS
Critical October 2026 compatibility note. GoDaddy now supports DNS API access with one domain, and its newer Domains v3 API uses Personal Access Tokens (PATs). However, the third-party Certbot GoDaddy plugin documented here still expects a classic key/secret pair. A v3 PAT is not a drop-in replacement. Confirm the classic API method works with your account before depending on this for automatic renewal. If it does not, stop and choose a verified PAT-compatible client or the manual DNS-01 guide for nonautomated issuance. Do not repeatedly attempt production requests.

Who handles each part?

Light violet - GoDaddy DNS adminAuthoritative zone, API access and credential setup.
Light green - Server 01Certificate issuance, Apache and renewal on the first host.

Customize your certificate mission

Change the example labels. Every visible command and challenge hostname will update automatically. Values are not sent to SMORTLER, stored in cookies, or saved in local storage. Do not enter passwords, API keys, private keys, or tokens.

Both servers share a DNS zone, but each issues its own certificate.

Example: example.com - public authoritative DNS must be checked.

Example: lab or office.team. Empty is allowed.

Example: private-01 (one DNS label only).

This is not a secret. Required before copying the certificate issuance commands.

SERVER 01 CERTIFICATEprivate-01.lab.example.com
SERVER 01 TXT CHALLENGE_acme-challenge.private-01.lab.example.com
Example DNS names are valid. Add a real email to enable production/staging certificate command copying.
MISSION 1 / LIGHT VIOLET / DNS ADMIN
Violet examining DNS security settings

GoDaddy - establish the real authority.

Domain registration and DNS hosting are different things. GoDaddy can manage your registration while another provider serves public DNS. The GoDaddy DNS API can only change records in a zone it actually hosts.

01

Confirm the public authoritative DNS zone

From any Linux machine with dig, check which nameservers serve your base domain and where the actual ACME challenge name is delegated. This is read-only.

DNS admin / identify nameservers and challenge zone
dig +short NS example.com
dig +noall +answer +authority SOA _acme-challenge.private-01.lab.example.com
dig @1.1.1.1 _acme-challenge.private-01.lab.example.com SOA +noall +answer +authority

Confirm that the authoritative public zone for the challenge is managed at GoDaddy. An empty TXT lookup before issuance is normal. If DNS is managed at Route 53, Cloudflare, DigitalOcean or elsewhere, use that provider instead.

02

Choose compatible GoDaddy API credentials

GoDaddy announced in April 2026 that one domain is sufficient for its DNS API access. Its newer Domains v3 authentication guidance recommends scoped PATs, while the third-party plugin expects classic credentials. These systems must not be confused.

  1. Confirm that your account can still create and use a classic developer API key and secret for the older plugin.
  2. Verify the DNS zone belongs to the account and that write access is authorized.
  3. Keep the key and secret out of public pages, screenshots, emails and support tickets. Enter them only in a protected file on the private server.
  4. If classic keys or plugin DNS writes no longer work, stop. This guide does not claim to support PAT-based v3 automation.
03

Know the exact temporary record name

For Server 01, the ACME client will create a temporary TXT at _acme-challenge.private-01.lab.example.com. It removes the TXT record after validation. There is no reason to create a permanent challenge TXT record by hand.

GoDaddy record propagation can take longer than expected. The copyable commands allow 900 seconds, based on the plugin documentation. Production certificate issuance should follow a successful staging test.

MISSION 2 / FIRST PRIVATE SERVER

Server 01 - private-01

Follow this section as root on private-01 only. These examples assume Ubuntu 24.04, Apache, and a new certificate. Do not run these steps on a machine with an existing Certbot setup until you have checked for conflicts.

01

Inspect the machine before making any changes

Check your installed Certbot versions and any existing renewal schedules first. The GoDaddy plugin is third-party software and must be installed with the Certbot executable that actually runs it.

Server 01 / read-only inspection
cat /etc/os-release | head -n 5
command -v certbot || true
certbot --version 2>/dev/null || true
systemctl list-timers --all | grep -i certbot || true
ls -ld /etc/letsencrypt 2>/dev/null || true

If this host already has Certbot certificates or an automated renewal service, stop and plan how to reuse the existing configuration. This guide does not overwrite existing certificates or blindly add a second scheduler.

02

Install an isolated Certbot + GoDaddy plugin

On a clean host, use a Python virtual environment so the third-party DNS plugin and Certbot run together, without using system-wide pip. This is a dedicated Certbot installation at /opt/certbot-godaddy.

Server 01 / create isolated Certbot
apt update
apt install -y python3-venv python3-pip dnsutils
python3 -m venv /opt/certbot-godaddy
/opt/certbot-godaddy/bin/python -m pip install --upgrade pip
/opt/certbot-godaddy/bin/python -m pip install certbot-dns-godaddy
/opt/certbot-godaddy/bin/certbot --version
/opt/certbot-godaddy/bin/certbot plugins

Verify dns-godaddy appears in the plugin list. If installation fails, stop. Never install a Python package into the system interpreter just to force it to work.

03

Create a root-only credentials file

Use a classic GoDaddy developer key and secret compatible with the published third-party plugin - not a v3 Personal Access Token. Do not paste actual credentials into the HowTo page or any chat.

Server 01 / secure local directory and file
install -d -m 700 /root/.secrets/certbot
touch /root/.secrets/certbot/godaddy.ini
chmod 600 /root/.secrets/certbot/godaddy.ini
nano /root/.secrets/certbot/godaddy.ini

Place the following INI text in the editor. Replace the placeholders on your server with actual credentials. This block is file contents, not a shell command.

Server 01 / example INI file contents
dns_godaddy_key = YOUR_CLASSIC_GODADDY_KEY
dns_godaddy_secret = YOUR_CLASSIC_GODADDY_SECRET

Save with Ctrl+O, Enter, Ctrl+X. Then verify ownership and permissions without exposing the file contents.

Server 01 / lock down and inspect permissions
chown root:root /root/.secrets/certbot/godaddy.ini
chmod 600 /root/.secrets/certbot/godaddy.ini
stat -c '%a %U:%G %n' /root/.secrets/certbot/godaddy.ini

This process does not overwrite an existing file. If the credentials file already exists, review its contents and preserve any working integration before making changes.

04

Test DNS-01 against Let's Encrypt staging

This staging run tests GoDaddy API access and public TXT record propagation without issuing a trusted production certificate. GoDaddy propagation can be slow, so this example allows 900 seconds before validation.

Server 01 / staging certificate dry run
/opt/certbot-godaddy/bin/certbot certonly \
  --dry-run --non-interactive --agree-tos \
  --email YOUR_REAL_EMAIL@YOUR_DOMAIN \
  --authenticator dns-godaddy \
  --dns-godaddy-credentials /root/.secrets/certbot/godaddy.ini \
  --dns-godaddy-propagation-seconds 900 \
  --cert-name private-01.lab.example.com \
  -d private-01.lab.example.com

If the staging challenge fails, do not issue a production certificate. Inspect API permission errors, whether GoDaddy is the authoritative DNS host, and whether the plugin still supports your credential type.

05

Issue the certificate after the staging test passes

Run the production command once only after the dry run succeeds. The plugin creates and removes the temporary TXT record at _acme-challenge.private-01.lab.example.com. No public inbound port 80 is required for DNS-01 validation.

Server 01 / issue production certificate
/opt/certbot-godaddy/bin/certbot certonly \
  --non-interactive --agree-tos \
  --email YOUR_REAL_EMAIL@YOUR_DOMAIN \
  --authenticator dns-godaddy \
  --dns-godaddy-credentials /root/.secrets/certbot/godaddy.ini \
  --dns-godaddy-propagation-seconds 900 \
  --cert-name private-01.lab.example.com \
  -d private-01.lab.example.com
Server 01 / inspect issued certificate
/opt/certbot-godaddy/bin/certbot certificates
ls -l /etc/letsencrypt/live/private-01.lab.example.com/

Your expected certificate chain is /etc/letsencrypt/live/private-01.lab.example.com/fullchain.pem and private key is /etc/letsencrypt/live/private-01.lab.example.com/privkey.pem. Actual paths are confirmed by certbot certificates.

06

Connect Apache to the certificate you just issued

First inspect your existing Apache virtual hosts. Do not replace a working site configuration with a generic example.

Server 01 / inspect Apache and SSL configuration
apache2ctl -S
apache2ctl configtest
a2query -m ssl || true

If Apache already serves the site, update its matching HTTPS virtual host to reference the new certificate. For a new site, the following is the relevant portion of the :443 configuration (example only, not a shell command):

Server 01 / Apache SSL directives (example)
ServerName private-01.lab.example.com
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/private-01.lab.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/private-01.lab.example.com/privkey.pem
Server 01 / test and reload after saving vhost
a2enmod ssl
apache2ctl configtest
systemctl reload apache2
systemctl is-active apache2

Only reload Apache after configtest reports Syntax OK. Private servers still need working internal DNS, a reachable HTTPS service, and appropriate firewall rules for intended internal clients.

07

Schedule independent certificate renewals

Because this guide uses an isolated venv, the Ubuntu or Snap Certbot timer will not automatically invoke this binary. Set up a dedicated systemd timer on each server. The deploy hook checks Apache before reloading, and it runs only when Certbot reports a successful certificate renewal.

Server 01 / create Apache reload hook
cat > /usr/local/sbin/godaddy-apache-reload.sh <<'EOF'
#!/bin/sh
set -eu
/usr/sbin/apache2ctl configtest
/bin/systemctl reload apache2
EOF
chmod 755 /usr/local/sbin/godaddy-apache-reload.sh
Server 01 / create renewal systemd service
cat > /etc/systemd/system/smortler-godaddy-certbot.service <<'EOF'
[Unit]
Description=Renew GoDaddy DNS-01 certificate for private-01.lab.example.com
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
ExecStart=/opt/certbot-godaddy/bin/certbot renew --cert-name private-01.lab.example.com --quiet --deploy-hook /usr/local/sbin/godaddy-apache-reload.sh
EOF
Server 01 / create daily renewal timer
cat > /etc/systemd/system/smortler-godaddy-certbot.timer <<'EOF'
[Unit]
Description=Check GoDaddy DNS-01 certificate renewal daily

[Timer]
OnCalendar=daily
RandomizedDelaySec=1h
Persistent=true
Unit=smortler-godaddy-certbot.service

[Install]
WantedBy=timers.target
EOF
systemctl daemon-reload
systemctl enable --now smortler-godaddy-certbot.timer
systemctl list-timers --all smortler-godaddy-certbot.timer

These commands are for one certificate per host using the service name shown. If you have multiple managed certificates on the same host, coordinate one combined renewal strategy instead of overwriting this service. Do not enable duplicate renewal schedulers.

08

Prove that renewals and Apache reloads work

Server 01 / final staging renewal and timer test
/opt/certbot-godaddy/bin/certbot renew --cert-name private-01.lab.example.com --dry-run --run-deploy-hooks --deploy-hook /usr/local/sbin/godaddy-apache-reload.sh
systemctl is-active smortler-godaddy-certbot.timer
systemctl is-active apache2
/opt/certbot-godaddy/bin/certbot certificates

Expected results: staging DNS verification succeeds; the Certbot timer is active; Apache is active; and the certificate paths match the HTTPS virtual host. A dry run tests the renewal mechanism, but ongoing operations should still be monitored.

FINAL CHECK / VIOLET VALIDATION
Violet celebrating a successful validation

Ready for a secure renewal cycle?

Use these checkboxes to track your mission. They stay in this page only and do not represent a remote verification.

Violet's rule: Trust only a tested renewal. A browser padlock checks today's certificate, but a successful staging dry run plus an active timer checks the renewal path. Review certificate expirations and system logs periodically.
TROUBLESHOOTING / SAFE RECOVERY

When the challenge doesn't cooperate

GoDaddy is my registrar, but the DNS records do not change

Use the read-only NS and SOA checks. The relevant publicly delegated DNS zone might be at another provider. Certbot needs authority over the public challenge TXT name, not access to a private internal DNS-only record.

I have a Personal Access Token but the plugin asks for key + secret

They are different authentication methods. GoDaddy Domains v3 requires PATs, but the published third-party Certbot GoDaddy plugin documents classic key/secret configuration. Do not paste a PAT into a classic key field and assume the integration is supported. Use a validated modern authenticator instead.

The plugin cannot be found after installation

Run /opt/certbot-godaddy/bin/certbot plugins. Always use the Certbot executable inside the same Python venv as the plugin. Avoid mixing APT, Snap and venv plugin installations.

GoDaddy API authentication fails (401/403)

Check that your account is eligible, the DNS zone is in the correct account, credentials are compatible with the API endpoint in use, and the account can write DNS. Do not print secrets to logs. If the classic plugin no longer works, stop.

DNS verification times out or TXT is not visible

Check the challenge DNS name, zone delegation, and public resolver answers. The example waits 900 seconds. Avoid hammering production issuance; solve the problem in staging and inspect Certbot logs. After successful validation the temporary TXT will be removed, so its absence afterward is expected.

Apache still serves the old certificate

Use apache2ctl -S to check the matching HTTPS virtual host. Compare its certificate directives to the paths from /opt/certbot-godaddy/bin/certbot certificates. Run apache2ctl configtest before reloading. Verify from an actual HTTPS client using your internal network path.

I have an existing certificate and want to change only its authenticator

This is a new-certificate guide. Do not blindly run a second issuance or write over your renewal configuration. Check the existing certificate name, installation type and renewal hooks first. Our Route 53 guide shows a separate, safer existing-certificate reconfiguration pattern for an AWS-managed authoritative zone.

My account cannot automate DNS with a working plugin

Use manual DNS-01 validation if you can maintain certificates manually, or plan DNS challenge delegation to an API-supported provider. Do not assume a manually issued certificate will renew without a compatible automated authentication hook.

Technical references

SMORTLER + SI HowTo - Return to the HowTos directory. Written as an educational field guide. No personal credentials or host settings are transmitted or saved by this page.