Setup guide

GoDaddy DNS v3 setup guide for sslcertificates.io

This guide explains how to connect GoDaddy DNS v3 to sslcertificates.io, what credentials to prepare, and how to operate safely in Test (Let's Encrypt Staging) and Live (publicly trusted issuance) environments.

What this integration does

GoDaddy DNS v3 DNS-01 follows the shared DNS contract: authenticate, list zones, create a TXT, read it back, poll public DNS, delete only the owned record, verify removal and audit the operation. GoDaddy rate limits are strict; the connector honours Retry-After and never replaces the whole zone.

Category: DNS Providers. Public integration page: /integrations/godaddy.

Outcomes

Publish DNS-01 challenges on GoDaddy DNS v3
Issue wildcard certificates
Remove challenge records after validation

Prerequisites

Active GoDaddy DNS v3 account
API access that can create and delete TXT records
API key and secret from the GoDaddy developer portal with DNS scope.

Authentication and credentials

Authentication mode in the catalog: sso_key.

Fields the connection form expects: API key (required); API secret (optional); Username (optional)

Store secrets in a password manager while you paste them once into sslcertificates.io. Values are encrypted at rest and are not shown again after save. Prefer narrowly scoped credentials over admin passwords.

API key and secret from the GoDaddy developer portal with DNS scope.

Permissions (least privilege)

API key and secret from the GoDaddy developer portal with DNS scope.

GoDaddy rate limits are strict; the connector honours Retry-After and never replaces the whole zone.

Connect in the workspace

Sign in to sslcertificates.io
Open Integrations
Choose GoDaddy DNS v3
Enter the connection details
Test the connection
Select the resources you want to manage

After Test connection succeeds, run Discover so the platform lists zones, subscriptions, domains, or deploy targets you are allowed to see. Select only resources this organization should manage.

Test vs Live certificate environments

Test uses Let's Encrypt Staging as the CA directory. Staging certificates are not trusted by browsers; use them to prove DNS-01, HTTP-01, deploy scripts, and webhooks without consuming production rate limits.

Live uses Let's Encrypt Production (or a commercial CA you connect) for publicly trusted certificates. The integration connection is the same; only the API key environment and CA selection on the certificate order change.

Create separate API keys labeled Test and Live. Do not reuse a Live key in CI that hammers validation endpoints.

DNS-01 lifecycle on GoDaddy DNS v3

For DNS-01 validation the platform publishes a TXT record at _acme-challenge.<hostname> with the value from the certificate order. After Let's Encrypt accepts the challenge, the connector removes only the TXT value it created.

Wildcards such as *.example.com require DNS-01; HTTP-01 cannot validate them. If CAA records restrict which CAs may issue, fix CAA before ordering or issuance fails with a stable error — the platform does not silently choose another CA.

Check public resolvers for the TXT name before calling POST /api/v1/certificate-orders/{id}/validate. Propagation delays return dns_propagation_timeout; retry with backoff rather than spamming validate.

Example flow (Test)

Create a Test API key with certificates:write and integrations:write.
Connect GoDaddy DNS v3 and select the hosted zone that contains your test hostname.
POST /api/v1/certificates with validation: dns-01 and environment: test.
Confirm the _acme-challenge TXT appears in GoDaddy DNS v3, then validate.
After issuance succeeds, confirm cleanup removed the owned TXT record.

Discovery

Discovery runs only after authentication succeeds. The integration enumerates resources the credential may read — hosted zones, subscriptions, domains, clusters, or load balancers depending on GoDaddy DNS v3. If discovery returns empty, the credential is usually too narrow or pointed at the wrong account or region.

Renewal and ongoing operation

When GoDaddy DNS v3 participates in deployment or DNS automation, renewals re-use the same connection. Watch webhook events such as certificate.renewal_failed and verify the external endpoint after every replacement. A renewed certificate in inventory is not proof HTTPS serves the new leaf.

Disconnect and credential rotation

Open Workspace → Integrations → GoDaddy DNS v3 → Disconnect to remove stored credentials from this organization. DNS integrations should delete only TXT records the platform created for ACME challenges. Rotate vendor tokens on a schedule; update the integration, run Test connection, and revoke the old credential at the vendor.

Troubleshooting

Symptom	Likely cause	What to do
Test connection fails immediately	Wrong host, region, or token	Re-copy credentials; confirm clock skew and TLS to the vendor API
Discovery is empty	Scoped IAM/token cannot list resources	Widen read permissions temporarily, discover, then tighten
Order stuck validating	DNS or HTTP challenge not public yet	Inspect the order challenges; wait for propagation; POST validate
Deploy reported success but HTTPS unchanged	Old cert still bound on the edge	Compare served SHA-256 to expected leaf; reload or bind again
`insufficient_scope` from sslcertificates.io API	API key missing abilities	Mint a key with integrations:write and certificates:write

Stable API error codes are documented at /docs/errors. Include X-Request-Id when contacting support.

Official vendor documentation

https://developer.godaddy.com/doc/endpoint/domains

Continue

Back to GoDaddy DNS v3 Create account