Certificate authorities
Let's Encrypt is built in. Add another CA when a customer needs certificates from it, free or from your paid account.
Which CAs work
Any CA that speaks ACME (RFC 8555) works. These are ready to pick:
| CA | Cost | What you need |
|---|---|---|
| Let's Encrypt | Free | Nothing. Built in; every certificate uses it unless you pick another CA. |
| ZeroSSL | Free | EAB credentials: ZeroSSL dashboard > Developer > EAB Credentials > Generate. |
| Google Trust Services | Free | A Google Cloud project; gcloud publicca external-account-keys create gives the EAB key ID and HMAC key. |
| DigiCert | Paid | CertCentral > Automation > ACME Directory URLs > Add ACME URL. Use the directory URL it shows, plus its key ID and HMAC key. |
| Sectigo | Paid | EAB key ID and HMAC key from Sectigo Certificate Manager or your reseller portal (DV, OV or EV directory). |
| SSL.com | Free account | SSL.com account > API Credentials > ACME: the EAB key ID and HMAC key. |
| GoDaddy | Paid (the certificate you bought) | One entry per certificate you bought: the EAB Key ID, EAB Key Data and directory URL from that certificate's ACME Setup page. See GoDaddy step by step. |
| Any other | - | Its ACME directory URL, and EAB credentials if it gives you some. |
Add a CA
- Go to Settings > Certificate authorities and click the CA under Add a certificate authority (or Other ACME CA).
- Paste the EAB key ID and EAB HMAC key. The directory URL is filled in for the presets. The account email is optional: blank uses each certificate's contact email.
- Click Save, then Test: NeverLapse creates its account at the CA. A wrong key or URL shows the CA's own error here, before any certificate depends on it.
Use it for a certificate
On the certificate's Edit page, pick the CA under Certificate authority and save. The Certificates page shows each certificate's CA in its own column. Validation is the same DNS-01 through your DNS provider (or Manual DNS) as with Let's Encrypt, and renewals, deployment and alerts work the same way.
Switching an existing certificate to another CA takes effect on its next renewal; click Issue now (or Renew now) to switch right away.
GoDaddy step by step
Use this when you've bought an SSL certificate from GoDaddy and want NeverLapse to issue and renew it for you. Needs NeverLapse Cert 1.3.1 or later.
1. Add the certificate in NeverLapse
On the Certificates page, click Add certificate. Enter exactly the name you bought the certificate for at GoDaddy. For a wildcard certificate that's *.example.com; for a multi-domain certificate, the same names you bought. Pick its DNS provider as usual (see DNS providers) and save.
2. Open the certificate's ACME Setup page at GoDaddy
- Sign in to your GoDaddy account.
- Go to SSL Certificates > Manage All > Manage All for SSL Certificates.
- Open the certificate you're setting up.
- Go to ACME Automation > ACME Setup. Leave this page open; you'll copy three things from it.
3. Add the GoDaddy entry in NeverLapse
- Go to Settings > Certificate authorities and click GoDaddy.
- Under Certificate this GoDaddy key is for, pick the certificate from step 1.
- Copy from GoDaddy's ACME Setup page:
GoDaddy shows the directory URL only inside your account, so copy your own; don't reuse one from another account. Copy only the address itself, not
On GoDaddy's ACME Setup page Paste into NeverLapse EAB Key ID EAB Key ID EAB Key Data EAB Key Data Under Example Certbot Commands, the address after --serverACME directory URL --serveror anything after the address. - Leave Account email blank unless you want a specific one (blank uses the certificate's contact email).
- Click Save. This also sets the certificate to issue from GoDaddy. The entry appears in the list as GoDaddy - <domain>.
- Click Test next to the new entry. NeverLapse creates its ACME account at GoDaddy and checks the key. If GoDaddy rejects it, its own error shows here: check you copied the right three values from the right certificate.
4. Issue it
On the Certificates page, click Issue now (or Renew now) next to the certificate. Validation is DNS-01 through the certificate's DNS provider, just like with any other CA, and a window shows each step live. From then on, renewals, deployment to your servers and alerts run on their own like any other certificate.
Good to know
- Bought another GoDaddy certificate? Repeat steps 1 to 4 with a new GoDaddy entry for it. One entry's key can't issue a different certificate.
- Keep the names within what you bought: the single name, the wildcard, or the names of a multi-domain certificate. Anything else and GoDaddy rejects the order.
- The same steps are in the app under Help > Certificate authorities > GoDaddy SSL certificates.
How long it takes
- Let's Encrypt usually validates within a minute.
- Other CAs can take several minutes (ZeroSSL: typically about 5). NeverLapse waits up to 20 minutes, asks the CA again if it seems stuck, and shows each step live on the Certificates page.
- After validation the CA can take a little longer to issue the certificate; NeverLapse waits up to 10 more minutes.
If a CA never validates
If NeverLapse confirmed the TXT record but the CA stays at "processing" until the wait runs out, the CA's servers probably can't query your domain's name servers. Some firewalls in front of self-hosted name servers block or rate-limit unfamiliar sources. Let's Encrypt can work while another CA doesn't. Check that your name servers answer DNS on UDP and TCP port 53 from anywhere, or try a domain hosted at a DNS provider such as Cloudflare or GoDaddy to confirm.
Other errors (wrong EAB key, account not approved, rate limits) come straight from the CA and show on the certificate. See Troubleshooting.