Setting up LetsEncrypt SSL in Godaddy.

SSL provider used: Let’s Encrypt (https://letsencrypt.org)

Let’s Encrypt is a free, automated, and open Certificate Authority.

The following steps could be used to install SSL successfully:

Step One:

  • Go to ZeroSSL(https://zerossl.com/), a browser based interface for getting a Let’s Encrypt SSL.
  • Click on “Online Tools”, then start the “FREE SSL Certificate Wizard”.
  • Follow the instructions, and you will end up with the following files: a) a domain key, b) a domain CSR (certificate signing request), c) an account key, and d) the domain certificate.
  • As part of the process, you will be asked to create two files with encrypted file names and encrypted content to put in sub-directories of the root directory of your hosting account. The path will look like this: /public_html/.well-known/acme-challenge/ These are the files that are used to prove that you have ownership of the website. The easiest way to do this is with an FTP client like FileZilla.

Step Two:

  • Now go to the cPanel for your domain on GoDaddy, scroll down to the Security section, and click on SSL/TLS.
  • Under “Install and Manage SSL for your site (HTTPS)”, click on “Manage SSL sites”.

There you will see a fairly simple form where you provide the following information: a) the domain, b) the certificate, c) the private key, and d) the certificate authority bundle. Items b, c, and d are all things you received from ZeroSSL.

A couple of important points: Included as parts of the certificate are the beginning and ending markers, e.g. “—–BEGIN CERTIFICATE—–” and “—–END CERTIFICATE—–“. If you don’t include these, you will get an error saying the certificate is not valid.

Also, the certificate you get from ZeroSSL has two parts, the actual certificate and the Certificate Authority Bundle (CABUNDLE). These are each marked with beginning and ending tags. They will need to be put into two separate boxes on the form.

Once you have filled in the form, and you have an indication that the content is correct, click on “Install Certificate”, and you are finished.

Step Three:
Redirect all mydomain.com hits to https://www.mydomain.com using .htaccess.

Sample Code:

To first force HTTPS, you must check the correct environment variable %{HTTPS} off, but your rule above then prepends the www. Since you have a second rule to enforce www., don’t use it in the first rule.

RewriteCond %{HTTPS} off
# First rewrite to HTTPS:
# Don't put www. here. If it is already there it will be included, if not
# the subsequent rule will catch it.
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# Now, rewrite any request to the wrong domain to use www.
# [NC] is a case-insensitive match
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule .* https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

You should now have a secure site. You may need to check your site to make sure that internal links reference https instead of http for everything to work right. If you are running WordPress, as I am, you can install a plug in like Easy HTTPS (SSL) Redirection that will take care of these chores for you. All you need to do is change the URL to https in the General settings.

Credits:

Cheers. Hope this helps.

Leave a Reply

Your email address will not be published. Required fields are marked *