Let's Encrypt Wildcard Certificate With the DNS Challenge

A wildcard certificate (*.example.com) covers every subdomain at once. Let's Encrypt only issues wildcards through the DNS-01 challenge, which proves you control the domain by creating a TXT record. With a DNS plugin, Certbot does it and renews it automatically.

Full guide: Full Let's Encrypt guide

1. Install Certbot and your DNS plugin

This example uses Cloudflare; plugins exist for Route 53, DigitalOcean, Google Cloud DNS and others.

sudo apt install certbot python3-certbot-dns-cloudflare

2. Create an API token

In Cloudflare create a token with Zone:DNS:Edit for this zone only, then save it in a file only root can read.

sudo mkdir -p /root/.secrets
sudo sh -c 'echo "dns_cloudflare_api_token = YOUR_TOKEN" > /root/.secrets/cloudflare.ini'
sudo chmod 600 /root/.secrets/cloudflare.ini

3. Request the wildcard

Include the bare domain too: *.example.com does not cover example.com itself.

sudo certbot certonly --dns-cloudflare \
  --dns-cloudflare-credentials /root/.secrets/cloudflare.ini \
  -d example.com -d '*.example.com'

4. Use it in your web server

Point every site at the same files.

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

5. Reload after renewal and verify

certonly does not touch your web server, so add a deploy hook, then test renewal.

echo -e '#!/bin/sh\nsystemctl reload nginx' | sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
sudo certbot renew --dry-run

6. Troubleshooting

Unauthorized or TXT not found: the token lacks DNS edit rights for that zone, or DNS has not propagated (add –dns-cloudflare-propagation-seconds 60). Manual DNS mode (–manual) works once but cannot renew automatically.

dig +short TXT _acme-challenge.example.com

FAQ

Does *.example.com cover sub.sub.example.com?

No. A wildcard covers one level only. Request *.sub.example.com separately if you need it.

Can I get a wildcard with the HTTP challenge?

No. Let's Encrypt requires the DNS-01 challenge for wildcard certificates.

Further reading: Certbot DNS plugins