Install GoDaddy Standard UCC SSL Certificate on CMC in SEM

Use this procedure when you need a single SSL certificate that secures multiple hostnames (SANs) for the CMC web interface or related services.

Important notes:

• Standard GoDaddy SSL certificates do not support SAN (Subject Alternative Names).

• To use multiple hostnames (typically up to 5 SANs), you must purchase a GoDaddy Standard UCC SSL certificate.

• The CSR generated on the CMC must already include all required SAN entries before you submit it to GoDaddy.
  

• The CMC expects the final certificate chain in a single combined PEM file in the correct order.
  

Administrators may need to secure the CMC with HTTPS for multiple hostnames (for example, a primary FQDN and several aliases). Using a regular GoDaddy Standard SSL certificate (without SAN support) or a CSR that does not include all SANs can result in hostname mismatch warnings or incomplete certificate chains in browsers.

Follow the steps below to generate the CSR on the CMC, purchase and issue the correct GoDaddy Standard UCC SSL certificate, and import it back into the CMC.

1. Generate the CSR on the CMC

1. Log in to the CMC with an account that has administrative permissions.

2. Navigate to Manager → Certificates (or the equivalent certificate/SSL management menu).

3. Choose Generate CSR.

4. Fill in the CSR details:

   • Common Name (CN):
     Set to the primary FQDN you want the certificate for (for example, primary.example.com).

   • Organization / Location fields:
     Fill in according to your company policy and certificate requirements.

   • Subject Alternative Names (SANs):
     Add all hostnames that must be covered by this UCC certificate (typically up to 5 SANs), for example:

     • primary.example.com

     • alias.example.com

     • another.example.com

5. Generate the CSR and save the CSR text/file.

6. Keep the CSR content available; you will copy/paste this CSR into GoDaddy in a later step.

2. Purchase the correct GoDaddy certificate

1. Log in to your GoDaddy account.

2. Go to the SSL Certificates section.

3. Do not select the regular Standard SSL product (this does not support SANs).

4. Purchase a Standard UCC SSL certificate (Unified Communications Certificate) that:

   • Supports multiple SANs (commonly up to 5 hostnames).

   • Matches your required validation level and validity period.

3. Submit the CSR to GoDaddy (Re-Key with the SAN CSR)

1. In the GoDaddy dashboard, open the Standard UCC SSL certificate you just purchased.

2. Select Re-Key / Manage or Re-Key Certificate (label may vary).

3. In the CSR field, paste the CSR generated from the CMC (the one that already includes the correct SAN values).

4. Confirm and submit the Re-Key request.

5. Wait for GoDaddy to accept the CSR and proceed to domain validation.
   

4. Complete domain validation with GoDaddy

1. GoDaddy will validate that you control the domain name(s) in the certificate (CN and SANs).

2. Complete the validation using the method GoDaddy provides, for example:

   • Email validation to an admin/hostmaster-style address.

   • DNS record validation (adding a TXT record).

   • HTTP file validation (uploading a verification file to a specific URL).

3. After all validations succeed, the certificate status in GoDaddy will change to Issued/Active.

5. Download the certificate files from GoDaddy

1. Once the certificate shows as Active, open it in the GoDaddy dashboard.

2. Download the certificate bundle for your platform. The bundle typically includes:

   • Root CA certificate

   • Subordinate/Intermediate CA certificate(s)

   • Your server certificate (the certificate issued for your domain, matching the CSR from the CMC)

3. GoDaddy generally provides these as separate .crt or .pem files. Save all of them to your workstation or admin machine.

6. Create the combined signed.pem file

1. On your workstation/admin machine, open a plain-text editor (for example, Notepad++, VS Code).

2. Create a new text file.

3. Concatenate the certificates in the following exact order:

   1. Root CA certificate

   2. Subordinate/Intermediate CA certificate(s) (in the order provided by GoDaddy)

   3. Your server certificate (for your domain / CSR)

4. Ensure that:

   • Each certificate block is intact, including the lines:

     • -----BEGIN CERTIFICATE-----

     • -----END CERTIFICATE-----

   • There are no extra characters, spaces, or blank lines outside the certificate blocks.

   • The certificates appear back-to-back in the file in the correct order.

5. Save the file as signed.pem.

7. Import the certificate into the CMC

1. Log back in to the CMC.

2. Navigate to Manager → Import Certificate (or similar SSL/certificate import menu).

3. Select Import certificate.

4. Browse to and select the signed.pem file you created.

5. Complete the import wizard:

   • Confirm that this is the new SSL certificate to be used by the CMC (or the relevant service).

   • If your product prompts you to replace an existing certificate, accept as appropriate.

6. If required by the product:

   • Apply the changes.

   • Restart the relevant web/service components so the new certificate becomes active.

8. Verify the new certificate

1. Access the CMC or the service UI via HTTPS using one of the hostnames in the certificate (for example, https://primary.example.com).

2. In your browser, open the certificate details.

3. Confirm the following:

   • The Common Name (CN) matches the primary hostname.

   • All configured SANs (Subject Alternative Names) are present and correct.

   • The issuer chain is complete:

     • Root CA → Subordinate/Intermediate CA → Your server certificate.

   • There are no certificate warnings or errors (for example, no hostname mismatch or untrusted issuer errors).

4. Optionally, test access using each hostname listed in the SANs to verify that all of them are covered and show no SSL warnings.

Once these checks pass, the GoDaddy Standard UCC SSL certificate (with SAN support) is successfully installed on the CMC using a CSR generated from the CMC.