From GoDaddy's Renewing my SSL Certificate docs (emphasis mine):

If you’re using a Domain Validation (DV) certificate with the primary domain for your account, and you’ve set the certificate to auto-renew, no further action is needed on your part. Renewing your SSL certificate is completely automated.

GoDaddy (and other such services) don't have access to customers' private keys, and the only way I can think of this to work is to re-use previous CSRs for a client.

My knowledge in this field is limited, so this is what I base this on:

If I'm correct in the items above, then this InfoSec SE thread all but confirms my assumption, and this question can be close as a duplicate.

  • 1
    The thing I am missing is: what mechanism does go daddy use for certificate management. For example, if the use the ACME protocol, you are running a tool on your box that does the work for you. Similar to how Let’s Encrypt works. (They invented it).
    – LvB
    Aug 25, 2023 at 16:35
  • 2
    You wouldn't generate a new CSR unless your private key or some details had changed (domain, company info, etc...) I'm not sure why you think GoDaddy wouldn't have access to your private key, since you can probably generate a CSR from their web panel. (and if you re-generate it probably creates a new private key) I did a quick google, and this tells you where it's stored: godaddy.com/help/wheres-my-private-key-32300 Btw, often the cert authority that you purchase from does generate the private key for you... if so you'll get a .pfx file. Aug 25, 2023 at 18:04
  • 1
    So it doesn't matter whether a new private key/csr is generated or not, GoDaddy or other host can automate the whole process with the cert provider. Aug 25, 2023 at 18:10
  • "A certificate signing request (CSR) is required by a public certificate authority (CA) to issue leaf / subscriber certificates" - A CSR is only a container for some information, signed with the private key to prove that issuer of the CSR has access to the private key. All what is actually needed from this container to issue a certificate is the public key, the rest can be added by the CA itself. And the public key could be extracted from the existing certificate when renewing, so there is no need to preserve the CSR. Aug 25, 2023 at 18:30
  • Note that Godaddy is a CA themselves. I don't know if the auto-renew is supported for external CA or only for Godaddy CA. Aug 25, 2023 at 18:33


You must log in to answer this question.

Browse other questions tagged .