A GoDaddy SSL certificate secures your site so it loads over HTTPS, and whether you need to buy one depends on what you host with GoDaddy. Websites + Marketing, Managed Hosting for WordPress and Managed Hosting for WooCommerce already come with an integrated SSL that GoDaddy installs for you, so you don't need a separate certificate on those.
Here's the catch. Buying a certificate is the easy part. As of October 2026, if one isn't set to renew automatically, you have a 90 day window to renew it, running from 60 days before to 30 days after expiry. Miss the expiry date itself and GoDaddy warns that your site shows an error message and won't be accessible to visitors, even though the window technically runs on.
GoDaddy SSL at a glance
| Situation | What GoDaddy says, as of October 2026 |
|---|---|
| Websites + Marketing, Managed WordPress, Managed WooCommerce | Integrated SSL already installed, nothing to buy |
| Domain and hosting in the same GoDaddy account | Enter your domain name and GoDaddy installs it |
| Domain or hosting elsewhere | Save the private key and CSR, verify the domain, download and install the files |
| Renewal window | 60 days before to 30 days after expiry |
| Auto-renew | Renews 60 days before expiry |
| Rekey | When the common name or issuing organisation changes; not for DASSL certificates |
| Install after rekey | Within 72 hours |
Setting up a certificate
If your domain and hosting sit in the same GoDaddy account, all GoDaddy needs is the domain name. You open SSL Certificates, choose Set Up, enter the domain, agree to the Subscriber Agreement and wait for the success message. You won't need a CSR either if the certificate is for the primary domain on a GoDaddy shared hosting account.
If your domain or hosting is with another provider, or in a different GoDaddy account, there are more steps:
- Generate a certificate signing request (CSR) on your server, or let GoDaddy's SSL Request Wizard make one.
- Save the private key. You can't continue the installation without it, and you should never send it to anyone, GoDaddy included.
- Prove you control the domain with the DNS or HTML method.
- Choose your server type, download the zip file and install the SSL files on your server.
- Select Confirm Installation and test the setup with a certificate checker.
DNS or HTML verification
GoDaddy recommends the DNS method. It emails you a TXT value to add at the root of your domain, through whichever company runs your nameservers, and the record has no effect on your website. The HTML method means creating a file named godaddy.html containing only your unique ID, in a /.well-known/pki-validation/ folder at your site's top level.
The detail most people miss: HTML verification only validates the root domain, such as coolexample.com. If you need www or another subdomain covered, use DNS. On a Windows server the folder has to be called /.well-known./ with the extra dot, or the server won't let you create it. Once you confirm, verification can take 5 to 10 minutes. Email verification, where you clicked a link sent to admin@ your domain, is no longer offered at GoDaddy at all.
How renewal works
Auto-renew kicks in 60 days before expiry to leave time for verification. Renewing early doesn't cost you days: the new period starts when your current subscription ends. If you've got a Domain Validation certificate on your account's primary domain with auto-renew on, there's nothing more to do.
For anything else, including a certificate for an add-on domain, you select Renew or Renew now, pay, and then, if the site is hosted elsewhere or it's an add-on domain, install the renewed certificate yourself. Put that install in your calendar. Paying isn't the same as being protected.
When to rekey a certificate
You rekey when you change the domain name the certificate covers, called the common name, or when you want to change the issuing organisation. You'll need a new CSR from your web server first. Paste it into the certificate's CSR field, select Add Change, and GoDaddy emails you when the rekeyed certificate is ready. You then have 72 hours to download and install it before the old one is terminated.
Two exceptions. Deluxe Automated SSL certificates don't need rekeying; to change the domain, you remove it from the subscription, which revokes its certificates, and request a new one. And don't revoke a certificate unless you mean to cancel it, because revoking cancels the SSL credit and you can't rekey it afterwards. On Deluxe and Extended Validation certificates you can change the common name but not the organisation's details.
Finding your private key
The private key is created on your server when you generate the CSR. On Apache, the SSLCertificateKeyFile line in your configuration file shows its path. On Nginx, look for ssl_certificate_key in your site's configuration. On Windows, the operating system holds it, and you export a .PFX file from the Microsoft Management Console that contains the certificate and the key together.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Testing the setup
Before you request the certificate, paste your CSR into a CSR decoder to check the common name and organisation are right. For a wildcard certificate, the common name needs the asterisk, so *.coolexample.com covers test.coolexample.com and www.coolexample.com. After installing, run GoDaddy's SSL checker. GoDaddy says most problems it flags are solved by rekeying the certificate and installing it again. And if the option to download your certificate is greyed out, that's because GoDaddy has already installed it for you.
My verdict on GoDaddy SSL
I'd check your hosting product before you buy anything, because on Websites + Marketing and Managed WordPress you're paying for something you already have. If you do need a certificate, turn auto-renew on and use DNS verification so www is covered. If you're weighing GoDaddy's hosting against other options, here's my Hostinger and GoDaddy comparison, and if you're thinking about putting Cloudflare in front of your site, my Cloudflare and GoDaddy guide covers that.
Keeping a site secure is table stakes. Helping your business show up in AI answers is where I come in. I run AI training and workshops for teams, and help businesses with AI enablement, AI automation and GEO, which is about getting your business seen and cited in AI answers. Most of that work is with SaaS marketing teams, telecom companies and small businesses. Here's how we can work together.
Frequently asked questions
Do I need to buy an SSL certificate for GoDaddy Managed WordPress?
No. Websites + Marketing, Managed Hosting for WordPress and Managed Hosting for WooCommerce come with an integrated SSL that GoDaddy installs for you.
When can I renew a GoDaddy SSL certificate?
From 60 days before to 30 days after the expiration date, as of October 2026. Auto-renew renews 60 days before expiry.
What happens if my GoDaddy SSL expires?
If you haven't completed the renewal by the expiration date, your website displays an error message and won't be accessible to visitors.
How quickly must I install a rekeyed GoDaddy certificate?
72 hours, to keep your server secure when the old certificate is terminated.
Can GoDaddy verify my domain by email for SSL?
No. GoDaddy no longer supports email-based domain validation. Use the DNS record or HTML file method.
