---
title: "Using PowerShell to Pass Let's Encrypt DNS Challenge and Get Free HTTPS Certificates"
description: "How to use the PowerShell Posh-ACME module to pass Let's Encrypt DNS challenges via GoDaddy and Cloudflare, automating the issuance of free wildcard HTTPS certificates."
canonical_url: "https://blog.markkulab.net/en/post/powershell-godaddy-dns-challenge"
author: "Mark Ku"
author_url: "https://blog.markkulab.net/en/author/mark-ku"
site: "Mark Ku's Tech Notes"
date_published: "2022-05-15 01:01:01 +0800"
category: "PowerShell"
tags: ["powershell", "https", "letsencrypt", "dns", "godaddy", "cloudflare", "ssl", "certificate"]
language: "en"
license: "CC BY 4.0"
license_url: "https://creativecommons.org/licenses/by/4.0/"
attribution: "when reusing or quoting, credit the author and link back to the original"
---

# Using PowerShell to Pass Let's Encrypt DNS Challenge and Get Free HTTPS Certificates

## Problem
Most websites these days need HTTPS for one reason or another. When you start out, free HTTPS certificates are tempting — Let's Encrypt is the most well known. But these certificates are only valid for three months, and renewing or reapplying every quarter is tedious. Whether you're going through the ACME HTTP challenge, the DNS challenge (for wildcards), or extending certs through nginx, it gets old fast.

If you want a wildcard certificate like `*.abc.com`, you must pass the DNS challenge, which is even more painful. So I wrote a script that quickly grabs a free Let's Encrypt cert.

## DNS verification flow
A quick recap of the DNS challenge flow:
1. Request the verification content from Let's Encrypt.
2. Add the TXT record specified by Let's Encrypt to your DNS host.
3. Retrieve the certificate.
4. Remove the TXT record from the host.

## The idea behind the implementation
Larger domain registrars like GoDaddy and Cloudflare both support API tokens, so you can update DNS records via a script.

## Domain providers that don't support DNS updates via API
For .tw domains, buying through GoDaddy or Cloudflare costs roughly NT$300 more per year than Taiwanese registrars. But most local registrars don't support modifying DNS through an API key. So I host my domains' DNS at GoDaddy for free, which makes it easy to script changes via API.

## Writing the PowerShell script

### Adjust the PowerShell execution policy
```
Set-ExecutionPolicy RemoteSigned
```
### Install the Posh-ACME module
```
Install-Module -Name Posh-ACME
```
### GoDaddy script (godaddy-dns-challenge.ps1)
```
Set-PAServer "LE_Prod"

$pArgs = @{GDKey="輸入Godaddy API KEY";GDSecret="輸入Godaddy Secret"}         

 New-PACertificate *.letgo.com.tw -FriendlyName *.letgo.com.tw -PfxPass password01 -AcceptTOS -Contact a4756830@gmail.com -DnsPlugin GoDaddy -PluginArgs $pArgs
 
Get-PACertificate | fl *
```
### Cloudflare script (cloudflare-dns-challenge.ps1)

```
Set-PAServer "LE_Prod"
$secToken = "輸入你的 Cloud Flare API 金鑰"
$pArgs = @{ CFToken = $secToken }
New-PACertificate *.letgo.com.tw -FriendlyName *.letgo.com.tw -PfxPass password01 -AcceptTOS -Contact anthony@sliema.com.au -DnsPlugin CloudFlare -PluginArgs $pArgs
Get-PACertificate | fl *
```

## Tools for monitoring certificate expiry
Besides uptime-kuma — which I've covered in [a previous post](https://blog.markkulab.net/2021/12/11/application-monitor-uptime-kuma/) and which can warn you 7, 14, or 21 days before a cert expires — [LetsMonitor](https://letsmonitor.org/monitors) also provides free SSL expiry monitoring and alerts. It makes a decent backup option.

![Let's Monitor 'Edit Monitor' dialog for letgo.com.tw certificate](https://blog.markkulab.net/content/markku/posts/powershell-godaddy-dns-challenge/images/HIv97Rq.png)

## Conclusion
Using a large domain provider's API to script the Let's Encrypt DNS challenge is genuinely convenient. Pair it with a scheduled task and you could probably manage a thousand machines without breaking a sweat. Free HTTPS certificates without spending a dime — hard to beat.

Execution screenshot
![PowerShell output listing Let's Encrypt certificate files](https://blog.markkulab.net/content/markku/posts/powershell-godaddy-dns-challenge/images/F1ptFJj.png)

[Reference 1](https://medium.com/@mark86092/%E9%80%8F%E9%81%8E-docker-%E7%B0%A1%E5%8C%96-letsencrypt-%E6%86%91%E8%AD%89%E7%9A%84%E5%8F%96%E5%BE%97-de14ab08fdeb
)

[Reference 2](
https://blog.onevinn.com/using-powershell-to-get-wildcard-certificate-from-lets-encrypt
)

[Reference 3](
https://israynotarray.com/other/20200510/1067127387/
)

[Reference 4](
https://anthonyspiteri.net/powershell-api-lets-encrypt-cloudflare/
)

---

## About this article and its author

Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/post/powershell-godaddy-dns-challenge)

License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original

### About the author

**[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software Solution Provider

- 10+ years senior software engineer, now an AI Builder
- Focused on large-platform architecture — North-American e-commerce, AI SaaS subscription billing
- Combining AI Agents and automation to build evolvable product foundations

### Free tools built by the author

All of these are free to use:

- [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded.
- [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer.
- [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer and compare/sync, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Kafka message browsing with monitoring & alerts, a bilingual UI (Traditional Chinese / English), a built-in AI assistant (natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux.
- [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT).
- [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single <MermaidViewer>, with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT).
- [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace.
- [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is.
- [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT).
- [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT).
- [Special Education](https://blog.markkulab.net/en/education): Learning materials crafted for special education students

### Daily podcasts

- [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml
- [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml
- [開源好物週報](https://blog.markkulab.net/en/category/open-source-weekly): A weekly two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml

### Newsletter

[Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.