![GoDaddy's own published SSL certificate page photograph, showing a secured https site being viewed on a laptop - the SSL certificate subject the title names]()
Buying an SSL certificate feels like buying a padlock: pay once, fit it, forget it. The contract behind it describes something closer to a subscription with an annual renewal built in.
We read GoDaddy's Certificate Services Agreement on 20 October 2026. It caps every SSL certificate at 398 days under an industry rule, locks free AutoSSL certificates to GoDaddy's own servers, and puts two expiry clocks on the setup service.
GoDaddy Certificate Services Agreement, read 20 October 2026
Published at godaddy.com/en-in/legal/agreements - stamped Last Revised 01-10-2026
SSL capped at 398 days · AutoSSL is GoDaddy-only · unused setup expires in 1 year
📅 Update log:
20 October 2026 — First publication. Read the same day: godaddy.com/en-in/legal/agreements/certificate-services-agreement, logged out, from India, nothing purchased and GoDaddy not contacted; the document carries its own stamp, Last Revised 01-10-2026. Recorded from this read: a CA/Browser Forum regulation caps SSL certificates issued on or after 1 September 2020 at 398 days' validity, and GoDaddy automatically re-validates and re-issues to stay inside it while the subscription is active; AutoSSL certificates are "intended exclusively for use on GoDaddy-managed infrastructure", exporting or installing them elsewhere is "strictly prohibited", and GoDaddy reserves revocation "without prior notice"; Extended Validation certificates require an in-depth application covering registration number, incorporation or registration agent and jurisdiction; code signing requires the private key to sit on a USB token physically separate from the signing device until a session begins, with the CSR generated on the signing machine; the SSL Setup Service is one-time, limited to one server and one SSL per site, allows 30 days from completion to request a review, and any unused setup expires one year from purchase; and where this agreement conflicts with the Universal Terms of Service, this agreement controls. No certificate price appears in the agreement and none is stated here.
Your SSL certificate expires in 398 days. Every SSL certificate does
We read GoDaddy's Certificate Services Agreement on 20 October 2026 — the contract covering its SSL, code signing and mark certificates. It is the freshest document on GoDaddy's legal shelf: it stamps itself Last Revised 01-10-2026, three weeks before we read it.
The clause that changes how you should think about an SSL purchase is short. "A new regulation introduced by CA/Browser Forum requires that all SSL certificates issued on or after September 1, 2020 be valid for no more than 398 days." GoDaddy's answer is to re-validate and re-issue automatically, "as long as the subscription is active".
That single rule is why a three-year SSL product is a three-year subscription with annual re-issues — and it applies to every certificate authority, not just this one.
What the agreement fixes about validity
| Point | What the agreement says | Note |
|---|
| Maximum validity of any SSL certificate | 398 days | Set by the CA/Browser Forum for certificates issued on or after 1 September 2020 - not a GoDaddy rule |
| What a multi-year SSL purchase actually buys | A multi-year subscription, re-issued annually | GoDaddy "will automatically re-validate and re-issue certificates" to stay inside the cap |
| What keeps the re-issues coming | An active subscription | The agreement's condition is "as long as the subscription is active" |
| Extended Validation (EV) vetting | "An extensive vetting process" starting with "an in-depth application" | Requires registration number, incorporation or registration agent and jurisdiction details |
| Who may sign the certificate request | You, or a representative you authorise | You remain "subject to and bound by all terms and conditions" either way |
| If this agreement and the Universal Terms disagree | This agreement wins | "In the event there is a conflict ... the provisions of this Agreement shall control" |
The 398-day cap is an industry rule, not a GoDaddy policy. The CA/Browser Forum is the body where certificate authorities and browser makers set the rules browsers enforce; a certificate issued outside those rules is one browsers may refuse to trust. Quoting it is GoDaddy explaining a constraint it does not control.
One structural clause is worth noting separately. Where this agreement and GoDaddy's Universal Terms of Service conflict, "the provisions of this Agreement shall control". For certificate questions, this is the document that governs.
The AutoSSL clause, and why it matters if you ever migrate
| Question | What the agreement says | Wording |
|---|
| Where an AutoSSL certificate may be used | GoDaddy-managed infrastructure only | "Intended exclusively for use on GoDaddy-managed infrastructure" |
| Exporting it to your own server | "Strictly prohibited" | Covers "exporting, installing, or utilizing" on non-GoDaddy-managed systems |
| What happens if you do | The certificate can be revoked | GoDaddy "reserves the right to revoke any such AutoSSL certificate found to be used outside of GoDaddy-managed infrastructure without prior notice" |
| Whether a warning comes first | The agreement provides for none | "Without prior notice" is the agreement's own phrase |
A free certificate bundled with managed hosting is bundled with that hosting. The agreement treats exporting one to a server GoDaddy does not manage as "strictly prohibited", and reserves revocation "without prior notice".
The practical reading is a migration checklist item rather than a warning: if a site is moving to another host, a certificate at the destination is part of the move. We are not suggesting GoDaddy has revoked anyone's certificate improperly — infrastructure-scoped certificates are standard across managed hosting providers.
Code signing: the key goes on a separate USB token
| Obligation | The agreement's wording |
|---|
| Keep sole control of the private key | "All reasonable measures necessary to maintain sole control of, keep confidential, and properly protect at all times" |
| Store the key on separate hardware | "At a minimum, the Private Key is stored on a USB token that is physically separate from the device that hosts the code signing function until a signing session is begun" |
| Generate the CSR on the signing machine | "Provide a certificate signing request (CSR) from the computer that is signing the code", using the account you will sign with |
| Expect a verification call | "The Registration Authority (RA) might contact you to provide additional information, if required" |
The physical-separation requirement is the one that catches teams out. It is not enough to keep the private key safe on the build machine; the agreement asks for it to live on a USB token "physically separate from the device that hosts the code signing function until a signing session is begun".
This too reflects an industry direction rather than a GoDaddy preference — hardware-backed key storage has become the baseline expectation for code signing generally. It is worth knowing before you plan a signing pipeline around a key file.
The setup service has two separate clocks
| Point | What the agreement says |
|---|
| What SSL Setup Service covers | Installing the certificate, configuring SSL, redirecting https, and updating mixed content errors, sitemaps and firewall settings |
| How many times | One-time service, limited to one server and one SSL per site |
| Window to report a problem | 30 days from setup completion, to "notify GoDaddy of any issues and request review of setup" |
| If you buy setup and never use it | "Any unused SSL Setup Service will expire one year from purchase" |
Thirty days to report a problem; one year before unused setup expires. Both run from fixed events — completion of the setup, and the date of purchase — not from when you notice an issue or decide to use the service.
No price for any certificate or for the setup service appears in this agreement, and none appears on this page. What the contract establishes is the shape of what you are buying, not what it costs.
How to read a "Last Revised" date
This agreement stamps itself 01-10-2026, which makes it the most recently revised document in GoDaddy's legal collection at the time of reading. That is worth noticing: the contract provides that GoDaddy may change it at any time in its "sole and absolute discretion", that changes are "effective immediately upon posting", and that your use of the service afterwards "shall constitute your acceptance".
The agreement also notes that GoDaddy "may occasionally notify you of changes or modifications to this Agreement by email", and disclaims liability if you miss that email because your account address is out of date. Check the "Last Revised" stamp yourself. Everything on this page describes the document as published on 20 October 2026.
Frequently Asked Questions
How long does a GoDaddy SSL certificate last?
No more than 398 days, and that limit is not GoDaddy's. The agreement explains it directly: "a new regulation introduced by CA/Browser Forum requires that all SSL certificates issued on or after September 1, 2020 be valid for no more than 398 days". GoDaddy's response is automatic — "we will automatically re-validate and re-issue certificates so that the certificate validity period is not greater than 398 days as long as the subscription is active". The CA/Browser Forum is the industry body of certificate authorities and browser makers; every certificate authority is bound by the same rule.
So what does a multi-year SSL certificate actually buy?
A subscription, not a single long-lived certificate. Because of the 398-day cap, a longer purchase buys repeated re-validation and re-issue rather than one certificate that sits in place for the whole term. The agreement ties that to one condition — the re-issues continue "as long as the subscription is active". The practical consequence is that lapsed billing and an expired certificate are the same event, and that you should expect a re-validation step roughly once a year rather than once a term. No price for any certificate appears in this agreement, and none appears on this page.
Can you move a free AutoSSL certificate to your own server?
No. "Automatically issued and installed SSL certificates ('AutoSSL certificates') provided by GoDaddy are intended exclusively for use on GoDaddy-managed infrastructure. Exporting, installing, or utilizing these certificates on non-GoDaddy-managed systems, servers, or environments is strictly prohibited." The agreement goes on to reserve the right to "revoke any such AutoSSL certificate found to be used outside of GoDaddy-managed infrastructure without prior notice". If you are planning to migrate a site off GoDaddy hosting, the bundled certificate is not something you take with you — budget for a certificate at the destination.
What does GoDaddy require of a code signing certificate?
A hardware separation most people do not expect. You must "ensure that, at a minimum, the Private Key is stored on a USB token that is physically separate from the device that hosts the code signing function until a signing session is begun", alongside "all reasonable measures necessary to maintain sole control of, keep confidential, and properly protect at all times" the key and any password or token that unlocks it. The certificate signing request must come from the machine that will sign the code, using the account you will sign with, and the Registration Authority "might contact you to provide additional information" during verification.
How long do you have to complain about an SSL setup?
Thirty days. The SSL Setup Service "includes installing your SSL certificate, configuring your SSL and redirecting https, and updating mixed content errors, the sitemaps, and firewall settings" — and "you have 30 days from setup completion to notify GoDaddy of any issues and request review of setup". Two further limits sit in the same clause: it is a one-time service covering one server and one SSL per site, and "any unused SSL Setup Service will expire one year from purchase". Buying setup help to use later has a shelf life.
Prices & codes last verified: October 20, 2026
Zoutons may earn a commission when you buy through links on this page. Every quotation, clause and characterisation here was read on 20 October 2026 from GoDaddy's own published Certificate Services Agreement at godaddy.com/en-in/legal/agreements/certificate-services-agreement, logged out, from India, with nothing purchased and GoDaddy not contacted. The document stamps itself "Last Revised: 01-10-2026" and states that GoDaddy may change it at any time, effective immediately on posting — so it may have changed since this page was written. Read the live agreement before relying on anything here. THE 398-DAY VALIDITY CAP IS AN INDUSTRY RULE SET BY THE CA/BROWSER FORUM, NOT A GODADDY POLICY — the agreement says so itself, and it binds every certificate authority, not this one alone. THIS IS A READING OF A PUBLISHED CONTRACT, NOT AN ALLEGATION. We do NOT claim that GoDaddy has ever revoked anyone's certificate improperly, refused a setup review, or applied any clause wrongly — we have no evidence either way, and infrastructure-scoped certificates and hardware key-storage requirements are common across hosting providers and certificate authorities generally. Where this page summarises a clause in plainer words, the agreement's own wording governs; quotations are reproduced exactly and the surrounding summary is our reading of them, not legal or security advice. THIS PAGE IS NOT LEGAL, SECURITY OR TECHNICAL ADVICE and must not be used as a substitute for reading the agreement, the applicable subscriber agreements, or taking professional advice. Nothing here should be relied on when designing a code-signing or key-management process. No certificate price, setup price or renewal figure is stated or implied anywhere on this page, because the agreement states none. Pricing, plans and terms change without notice; what GoDaddy publishes at the time you buy prevails over anything here.
Booking com 
Hostinger 
Dell 
Udemy 
Agoda 
Nykaa 
Myntra 
Ajio