GoDaddy SSL: free certificates on each hosting product and how to fix them

GoDaddy includes free SSL on most current hosting products, and each product issues it differently. cPanel Web Hosting uses AutoSSL, Managed Hosting for WordPress uses an integrated SSL, and the Websites + Marketing builder installs a certificate when you publish. In all three, the certificate appears only once the domain points to GoDaddy and no CAA record blocks it.

Steps follow the GoDaddy help center as of November 2026.

How GoDaddy issues certificates

Every current GoDaddy hosting product installs a free certificate automatically, but the mechanism differs by product:

• Web Hosting (cPanel) and Web Hosting Plus: AutoSSL provides a "free, Domain Validated (DV) SSL certificate". GoDaddy lists it as available for Web Hosting (cPanel) Deluxe, Ultimate and Maximum plans and all Web Hosting Plus plans. AutoSSL scans daily and installs certificates automatically, renewing expired ones; there is no domain limit.
• Managed Hosting for WordPress: the plan "comes with an integrated SSL certificate", activated when you attach a domain. GoDaddy says the activation can take up to 30 minutes.
• Websites + Marketing: "As a GoDaddy Websites + Marketing customer on any plan, you get a free SSL certificate for your website." It installs automatically when the site is published.

GoDaddy's help center does not say which certificate authority issues these free certificates. Run the SSL checker on the site to see the current issuer; you need that name for CAA. GoDaddy is also a CA itself (GoDaddy) and sells paid certificates, which have their own validation flow covered below.

Point your DNS at GoDaddy

The records depend on the product, but the rule is the same: the domain must resolve to the GoDaddy server that hosts the site.

• cPanel: add an A record for @ pointing to your cPanel IP and a CNAME for www pointing to the domain, removing conflicting records of the same type and name. The IP is in the hosting dashboard under Settings → Server. GoDaddy says DNS changes usually propagate within a few hours and can take up to 48 hours.
• Managed WordPress: add the domain under the site's Settings → Domains. If the domain is in the same GoDaddy account, GoDaddy updates DNS for you; otherwise point the A record to the IP GoDaddy shows. A domain in another account or at another registrar may need domain ownership verification.
• Websites + Marketing: connect the domain from Settings in the site editor and use the values the connect flow shows for your site.

For AutoSSL, GoDaddy also requires that any existing certificate on the domain is expired or uninstalled; AutoSSL will not replace a valid certificate you installed yourself.

CAA records: which CA to allow

For certificates GoDaddy issues, CAA must list godaddy.com or starfieldtech.com. GoDaddy's CAA article says that "if godaddy.com or starfieldtech.com is listed on that record we will continue the issuance process", and that if another CA is listed, "we can not issue the certificate to you." No CAA record at all means issuance continues.

example.com.  3600  IN  CAA  0 issue "godaddy.com"
example.com.  3600  IN  CAA  0 issue "starfieldtech.com"

That article covers GoDaddy-issued certificates. For the free AutoSSL, Managed WordPress and Websites + Marketing certificates GoDaddy does not publish a CAA value, and two help articles point at CAA as a cause of failure: Managed WordPress says "If your DNS has Certificate Authority Authorization (CAA) entries, you may need to delete those before the SSL installs", and the Websites + Marketing article says "Sometimes, your SSL certificate won't activate due to conflicting CAA records." The practical options are to remove CAA records while the free SSL installs, or to add a record for the CA that issued your current certificate. Check the published records with the CAA checker.

When the certificate is pending or will not activate

Each product has its own recovery step for a pending certificate, and it fixes most cases:

• cPanel: open cPanel Admin → Security → SSL/TLS Status, select the domains and click Run AutoSSL. A covered domain shows AutoSSL Domain Validated in the certificate status column. If a domain is not covered, check that its A record points to the hosting IP and that no other valid certificate is installed on it.
• Websites + Marketing: GoDaddy's fix is to "simply republish your website", which "will force the system to restart the SSL certificate installation process from the beginning". GoDaddy adds: "After republishing, it takes up to 30 minutes for the SSL certificate to be activated."
• Managed WordPress: allow up to 30 minutes after attaching the domain, remove CAA entries if present, and complete domain ownership verification if prompted.

For paid GoDaddy certificates, the certificate shows Pending Verification under SSL Certificates until domain control is proven. GoDaddy's DNS method adds a TXT record at @; after adding it click Check my update, and "It can take 5-10 minutes for your verification to complete." If CAA blocks issuance, GoDaddy reports: "A DNS CAA record exists for domain(s) coolexample.com which forbids the issuance of this certificate." (the help center's placeholder domain). Its fix is to have the CAA record removed by your DNS provider, or to add godaddy.com as above. A SERVFAIL during the CAA lookup is typically caused by an outage at your authoritative nameserver. For the general mechanism, see CAA record prevents issuance.

dig +short A example.com
dig +short CAA example.com

Force HTTPS

The redirect is a manual step on cPanel and automatic elsewhere. On cPanel, go to cPanel Admin → Domains → Domains and turn on Force HTTPS Redirect for each domain; GoDaddy notes that the site must have a valid SSL installed first. AutoSSL alone does not redirect visitors. On Managed WordPress, "The HTTPS redirect is automatically enabled after the SSL certificate install finishes." To add HSTS on cPanel, follow enable HSTS once every subdomain has a working certificate.

Fix mixed content

GoDaddy's guidance for WordPress sites (cPanel or Managed WordPress) is the Really Simple SSL plugin: install it, tick Mixed Content Fixer, and if pages still break, try the "Mixed content fixer - init hook" or back-end options. The plugin rewrites http:// references on the fly; it is better to fix the stored URLs as well (site address under Settings → General and old URLs in posts) so the site does not depend on the plugin. Find the remaining offenders with the mixed content scanner and read mixed content warning.

Can you upload your own certificate?

Yes on cPanel, Plesk, VPS and dedicated servers; no on Managed WordPress and Websites + Marketing. GoDaddy's third-party SSL article lists third-party certificates as supported on Web Hosting (cPanel), Windows (Plesk), VPS and dedicated servers, meaning you install them yourself; Managed Hosting for WordPress is "Not supported", and Websites + Marketing likewise. On cPanel, exclude the domain from AutoSSL in SSL/TLS Status first so AutoSSL does not overwrite your certificate, then install it as described in the cPanel SSL guide, including the CA bundle (install an intermediate certificate). With public certificates capped at 200 days since March 15, 2026 and 100 days from March 15, 2027, plan for at least two reinstalls a year.

Let's Encrypt can also be installed by hand on cPanel, but GoDaddy states that it "does not support auto-install on Web Hosting (cPanel) accounts", so on plans with AutoSSL, AutoSSL is the low-maintenance choice.

Verify

Both the domain and www should present a valid certificate. Check them from outside:

curl ssl.sh/example.com
curl ssl.sh/www.example.com
curl -sI http://example.com | grep -iE '^(HTTP|location)'

The SSL checker gives the same report in a browser: the issuer, the names covered, a complete chain and a future expiry date. Free certificates renew while DNS stays pointed at GoDaddy; for an outside alert if renewal stops, add the domain to ssl.sh monitoring (in development).