How to Get a Let's Encrypt Wildcard Certificate

1. Pick a DNS provider with a certbot plugin (Cloudflare, Route53, Gandi, DigitalOcean)
2. Install the plugin: apt install python3-certbot-dns-cloudflare
3. Create a credentials file with an API token (chmod 600)
4. Run: certbot certonly --dns-cloudflare --dns-cloudflare-credentials /root/.cloudflare.ini -d "*.example.com" -d example.com
5. Cert lands in /etc/letsencrypt/live/example.com/ — fullchain.pem + privkey.pem
6. Enable auto-renew: systemctl enable --now certbot.timer
7. Verify: Enterno SSL checker for any subdomain

• HTTP-01 challenge does NOT work for wildcards — DNS-01 only
• Wildcard does not cover the apex (*.example.com ≠ example.com). Add both with -d
• API token with minimum permissions (DNS:Edit zone only, not Account:Read)
• Let's Encrypt rate limit: 5 duplicate certs per week. Force renewal counts as new
• Manual DNS-01 does not support auto-renewal — use a plugin or switch to a provider with API

To obtain a Let's Encrypt wildcard certificate, you must use the ACME protocol with a DNS challenge. This requires a DNS provider that supports API access for adding TXT records. Use the command certbot certonly --manual --preferred-challenges=dns --email your-email@example.com --agree-tos -d '*.yourdomain.com' to initiate the process. Follow the prompts to add the necessary DNS TXT records for verification.

Obtaining a Let's Encrypt wildcard certificate involves several steps that ensure your domain is secure and validated. Here’s a detailed breakdown:

1. Prerequisites: Ensure you have the following before starting:
• A registered domain name.
• A DNS provider that allows API access or manual entry of DNS records.
• Certbot installed on your server. You can install it using the command:

sudo apt-get update && sudo apt-get install certbot

2. Choose Your Validation Method: Let's Encrypt allows for various validation methods. For wildcard certificates, you must use the DNS challenge. This method requires you to create a specific TXT record in your DNS settings.
3. Initiate the Certificate Request: Use Certbot to request your wildcard certificate. The command structure is as follows:

certbot certonly --manual --preferred-challenges=dns --email your-email@example.com --agree-tos -d '*.yourdomain.com'

4. Follow the Prompts: After executing the command, Certbot will provide you with a DNS TXT record that you need to add to your domain’s DNS settings. For example, it might instruct you to create:

Type: TXT
Name: _acme-challenge.yourdomain.com
Value: abcdefghijklmnopqrstuvwx

5. Add the DNS Record: Log in to your DNS provider's management console and add the TXT record as specified by Certbot. Save your changes.
6. Verify DNS Propagation: Before proceeding, ensure the DNS record has propagated. You can check this using tools like DNS Checker or by using the command:

dig TXT _acme-challenge.yourdomain.com

7. Complete the Certificate Request: Once the DNS record is confirmed, return to your terminal where Certbot is running. Press Enter to allow Certbot to verify the record. If successful, you will receive confirmation and your wildcard certificate files will be generated.
8. Locate Your Certificate Files: By default, Certbot stores your certificates in /etc/letsencrypt/live/yourdomain.com/. You will find the following files:
• fullchain.pem: The certificate file.
• privkey.pem: The private key file.
9. Configure Your Web Server: Depending on your web server (e.g., Apache, Nginx), you will need to configure it to use the new wildcard certificate. For example, in Nginx, your server block might look like:

server {
    listen 443 ssl;
    server_name *.yourdomain.com;
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
}

10. Test Your Configuration: After updating your server configuration, test it to ensure everything is functioning correctly. You can use a command like:

sudo nginx -t

11. Renew Your Certificate: Let's Encrypt certificates are valid for 90 days. To automate the renewal process, you can set up a cron job by running:

echo '0 0 * * * /usr/bin/certbot renew --quiet' | sudo tee -a /etc/crontab > /dev/null

12. Conclusion: Following these steps will allow you to successfully obtain and implement a Let's Encrypt wildcard certificate, enhancing the security of your domain and its subdomains.