SSL certificate management

HTTPS certificates in GOCO follow two paths depending on how a site is deployed: managed-hosting sites are fully automatic (the platform issues and renews; you only complete the DNS setup), while your own servers are configured on the console’s SSL Certificates page — powered by acme.sh, issuing, deploying and renewing automatically with free CAs such as Let’s Encrypt, so it’s completely free.

Which scenario are you in?

Deployment	Who manages certificates	What you do
GOCO managed hosting	The platform issues and auto-renews	Add the DNS records shown, then zero maintenance
Your own server (SSH + BT-Panel)	An acme.sh config on the SSL Certificates page	Create one certificate config per server and enable auto-renew

Managed hosting: automatic issuance & renewal

Managed-hosting sites never need a manual certificate request. When you bind a domain, the platform registers a managed hostname for it and prepares issuance; you only add the records shown at your DNS provider (routing CNAME, certificate DCV CNAME, ownership TXT). Once they propagate, the certificate is issued automatically. Full DNS steps are in the managed-hosting tutorial’s “Method 5” section.

Renewal is just as automatic: the _acme-challenge CNAME used for certificate validation is a one-time delegation — keep it after issuance, and the platform re-issues a fresh certificate before expiry with no action from you. If a removed DNS record ever blocks renewal, you’re alerted automatically (the Sites list’s SSL column shows “Cert error”).

Domain status meanings

The site detail’s “Domains needing DNS setup” section shows each domain’s live status:

Status	Meaning	What to do
Awaiting DNS	Domain created, but the routing record hasn’t propagated yet	Add the routing CNAME and wait for propagation
Issuing certificate	DNS is live; the HTTPS certificate is being issued	Confirm the certificate DCV CNAME is added, then wait
Active	DNS and certificate are both ready; the site serves HTTPS	Nothing
Error	Issuance or validation failed	Fix the DNS records per the troubleshooting below, then click “Check status”
Suspended	The domain has been suspended	Contact support for details

Caution

If the domain is on Cloudflare, the routing CNAME must be “DNS only” (grey cloud). The orange proxy breaks both resolution and certificate issuance — it’s the most common reason a domain gets stuck.

Your own server: acme.sh automatic certificates

Certificates for your own servers live on the console’s SSL Certificates page: they’re issued and renewed on BT-Panel servers over SSH via acme.sh, auto-renewing before expiry and deploying to the matching sites. Each server can have only one certificate config.

1. New certificate

   On the SSL Certificates page click “New certificate” and pick a server (name optional — left blank it’s auto-named). If you haven’t bound a server yet, start with Server binding & management.

2. Pick a CA and challenge

   • CA: Let’s Encrypt (90-day · free · most widely trusted), ZeroSSL (90-day · free), BuyPass (180-day · free, fewer renewals).
   • Challenge: the default is HTTP-01 (webroot) — needs port 80 reachable, issues per domain. DNS-01 (CloudFlare) validates through your bound CloudFlare token — no port 80 needed, and it enables wildcard certs. If no token is bound yet, bind one on the DNS page first.

3. Choose which domains it covers

   Prefer “All domains on this server”: every site hosted on the server gets a certificate, and new sites are auto-included and issued within ~24h. “Specific domains” is deprecated.

4. Enable auto-renew

   With Auto-renew on, the system renews and deploys before expiry: set how many days early to renew and the daily check window (prefer “Random (00:00–06:00 Beijing · recommended)” to spread load and reduce the chance of CA rate limiting). Optionally turn on Force HTTPS to redirect HTTP → HTTPS on issue/renew.

5. First issuance

   Click “Issue / renew”, tick the domains to process in the picker (domains with no cert / expired / expiring are pre-selected) and confirm. Each domain deploys as soon as its certificate is issued; still-valid certificates are skipped automatically.

Tip

The editor’s Domains tab shows each domain’s live certificate status (Deployed / Not deployed / Expiring / Expired / No cert) and supports bulk issuance, toggling Force HTTPS and viewing certificate details. Run history keeps the last 60 days of renewal runs.

Certificate config status meanings

The Status column on the SSL Certificates list:

Status	Meaning
Idle	Config created but never issued — open it and click “Issue / renew” to deploy
Issuing	Requesting / renewing domain by domain
Deployed	Certificates issued and deployed to the sites
Expiring	Some domain’s certificate is close to expiry (handled automatically when auto-renew is on)
Expired	Some domain’s certificate has expired — renew soon
Failed	The last run failed for some domains — click “Retry renewal”; details in the “Last error” column

Troubleshooting failed issuance / renewal

Managed hosting: stuck on “Awaiting DNS”

1. Confirm the routing CNAME (@ → the record value shown in the console, e.g. tw1.goco.cc per shard, possibly in a goco-host.com form) exists at your DNS provider — without it the domain can’t open at all.
2. DNS propagation usually takes minutes to hours; afterwards click “Check status” in the site detail.
3. For domains on Cloudflare, make sure the routing CNAME is a grey cloud (DNS only) — the orange proxy must be off.
4. If an ownership TXT (_cf-custom-hostname) is requested, add it as well.

Managed hosting: stuck on “Issuing certificate” (DCV stuck)

1. Check the certificate DCV CNAME is added with the complete value: host _acme-challenge, value like <domain>.<delegation-tag>.dcv.cloudflare.com — a partially copied value keeps it stuck forever.
2. Mind the host notation: most DNS providers expect the relative form _acme-challenge — don’t append the domain again (unless your provider requires full hostnames).
3. After adding the record, wait for propagation and click “Check status”. This record is a one-time delegation — keep it after issuance; renewals reuse it.

Managed hosting: apex is Active but www doesn’t open

www is a separate managed hostname with its own certificate and needs its own DNS record: tick “Also bind www” when binding the domain, then add the CNAME shown on the www row of the site detail’s “Domains needing DNS setup”. The apex being “Active” doesn’t make www active — each validates on its own.

Your own server: issuance failed

1. The domain doesn’t resolve to this server’s IP — HTTP-01 issuance will fail (the domain list flags these directly). Point the domain’s A record at the server first, then retry.
2. Port 80 unreachable: HTTP-01 requires port 80; if you can’t open it, switch to the DNS-01 challenge.
3. DNS-01 without a token: if you see “No CloudFlare token bound”, bind one on the DNS page first, or switch back to HTTP-01.
4. CA rate limits: mass issuance in a short window (especially with “Force re-issue”) consumes CA quota — wait and use “Retry renewal”; the random renewal window lowers the chance of hitting limits.
5. For the exact error, check the list’s “Last error” column and the editor’s Run history tab — each run shows issued / still-valid / failed per domain.

Note

Removing SSL from a domain doesn’t delete the domain or the site, and doesn’t revoke the issued certificate — you can re-deploy it any time.

Related pages

Open the SSL Certificates page ↗

Managed-hosting DNS tutorial

Server binding & management