Knowledgebase

A wildcard certificate secures a domain and all of its subdomains (*.example.com) with a single certificate. Unlike standard HTTP validation, wildcard certificates require a DNS-01 challenge, proving domain ownership through a DNS TXT record instead of a web-accessible file.

Prerequisites

• Certbot installed
• Access to your domain's DNS management panel
• A registered domain you control

Step 1 — Request the Certificate with Manual DNS Validation

sudo certbot certonly --manual --preferred-challenges dns \
  -d example.com -d *.example.com

Step 2 — Add the TXT Record Certbot Provides

Certbot will pause and display something like:

Please deploy a DNS TXT record under the name:
_acme-challenge.example.com

with the following value:
gfj9Xq...Rg85nM

Log in to your DNS provider and create this exact TXT record.

Step 3 — Verify DNS Propagation Before Continuing

dig +short TXT _acme-challenge.example.com

Wait until this returns the value Certbot gave you — DNS propagation can take a few minutes.

Step 4 — Continue the Certbot Prompt

Press Enter in the Certbot terminal once the TXT record is confirmed live. Certbot verifies it and issues the certificate.

Step 5 — Locate the Certificate Files

sudo ls /etc/letsencrypt/live/example.com/

Step 6 — Configure Nginx to Use It

server {
    listen 443 ssl;
    server_name example.com *.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}

Automating Renewal for Wildcard Certificates

Manual DNS challenges don't renew automatically by default, since they require a new TXT record each time. Two options:

• Use a Certbot DNS plugin for your specific DNS provider (e.g. certbot-dns-cloudflare) which can update DNS records via API automatically
• Set a calendar reminder to manually renew every ~60 days if no plugin is available for your provider

Example: Automating with a DNS Plugin (Cloudflare)

sudo apt install python3-certbot-dns-cloudflare -y

sudo certbot certonly --dns-cloudflare \
  --dns-cloudflare-credentials /root/.secrets/cloudflare.ini \
  -d example.com -d *.example.com

This approach allows fully automatic renewal since Certbot can create/remove the TXT record itself via your DNS provider's API.

Common Errors

"Incorrect TXT record" — DNS hasn't propagated yet, or the record was entered with extra characters/quotes; wait and re-verify with dig.

Renewal fails silently after 90 days — manual DNS challenges require re-doing this whole process unless a DNS API plugin is configured.

Best Practices

• Use a DNS plugin for your provider whenever possible, to enable full automation
• Verify propagation with dig before continuing the Certbot prompt
• Track wildcard certificate expiry manually if using the fully manual method

FAQ

Why can't I use the standard HTTP challenge for a wildcard certificate?
Let's Encrypt requires DNS-01 validation for wildcards because HTTP-01 can only prove control of one specific hostname, not an entire subdomain space.

Continue Reading

• How to Install Let's Encrypt SSL with Certbot (Nginx & Apache)
• How to Renew and Auto-Renew Let's Encrypt Certificates
• Nginx Virtual Hosts: Hosting Multiple Websites

Browse more articles in SSL/TLS & Certificates.