Get a wildcard certificate
A wildcard covers anything.example.com with one certificate. It cannot be issued the usual way, so this is the setup for the other way.
When you actually want one
- Lots of subdomains that come and go. A wildcard means a new subdomain works the moment you point it here, with no certificate step at all.
- Subdomains that are not reachable from the internet. http-01 cannot validate something the certificate authority cannot reach.
- Per customer subdomains, where issuing one certificate per customer would be a lot of certificates and a lot of renewals.
When you do not want one: a handful of fixed names. Several small certificates fail more gracefully than one large one, because a failed renewal on a wildcard takes everything with it.
Why it needs dns-01
The usual validation asks for a file over port 80 at the exact name you are claiming. You cannot
serve a file at *.example.com, because that is not a name anybody can connect to.
So the authority asks you to put a specific TXT record in your DNS instead, at
_acme-challenge.example.com. Proving you can write records in a zone proves you
control every name in it, which is exactly what a wildcard is claiming.
Step 1: give the manager DNS credentials
- Settings, Certificates.
- Choose your DNS provider from the list.
- Paste in the credentials it asks for.
- Save.
They are stored encrypted and never shown again. You can replace them later but you cannot read them back out, which is on purpose.
Scope the credentials if your provider lets you
These credentials can write records in your zone, which is a lot of power for a certificate job. Several providers support restricted tokens that can only touch _acme-challenge records. Use one if yours does.
Step 2: ask for the certificate
- Certificates, Get one from Let's Encrypt.
- Domains:
*.example.com, and on a second lineexample.comif you want the bare name covered too. - Choose dns as the validation method.
- Request, and wait. It takes a little longer than http-01 because the record has to propagate before the authority checks it.
A wildcard does not cover the apex
*.example.com covers www.example.com and shop.example.com. It does not cover example.com itself. Add the bare name as a second entry if you serve it, which almost everybody does.
And it only covers one level
*.example.com does not cover a.b.example.com. If you need that, add *.b.example.com as another name on the same certificate.
Step 3: use it
Open each site, choose the wildcard certificate, turn on https, and apply. One certificate can be used by as many sites as its names cover.
You can also put *.example.com in a single site's server names, so one site answers
for every subdomain. That is right when they all behave the same way, and wrong the moment one of
them needs a different pool.
Renewal
Automatic, the same as any other certificate, and it uses the same DNS credentials. Nothing has to be reachable over port 80 for a wildcard renewal, which is one of the quiet advantages.
The trap
One certificate in front of everything
A wildcard is one private key that can impersonate every name under your domain. It sits on every load balancer, and it goes into every backup. That is a bigger blast radius than a set of single name certificates, and it is worth deciding about deliberately rather than by accident.
Also, a failed renewal takes every subdomain down at once rather than one of them. Watch the expiry column.