Let's Encrypt Wildcard: Free Certificate for All Subdomains

What Is a Wildcard Certificate?

A standard SSL certificate protects a single domain: example.com. A Wildcard certificate protects the root domain and all first-level subdomains: *.example.com. This means app.example.com, api.example.com, mail.example.com, and any other subdomain are all protected by a single certificate.

Let's Encrypt has supported Wildcard certificates since 2018 through the ACME v2 protocol with DNS-01 validation. The certificate is free and auto-renews every 90 days if configured correctly.

When Do You Need a Wildcard Certificate?

• You run multiple applications on different subdomains
• You are building a SaaS platform that creates a subdomain for each customer
• You want to simplify certificate management instead of issuing one per subdomain
• You run multiple environments: staging.example.com and dev.example.com

When You Do Not Need One

If you have only one or two subdomains, a standard certificate for each is simpler and easier to set up. Let's Encrypt allows issuing up to 50 certificates per domain per week.

Prerequisites

• A Linux server with root access
• A domain you own with the ability to modify DNS records
• Certbot installed (the official Let's Encrypt tool)
• A DNS provider that supports API (for automatic renewal) or accepts manual modification

Step-by-Step Setup

Step 1: Install Certbot

On Ubuntu/Debian:

sudo apt update && sudo apt install certbot -y

On AlmaLinux/Rocky:

sudo dnf install epel-release -y && sudo dnf install certbot -y

Step 2: Request the Certificate

Wildcard certificates require DNS-01 validation exclusively. HTTP-01 validation cannot be used:

sudo certbot certonly --manual --preferred-challenges dns -d "example.com" -d "*.example.com"

Certbot will ask you to add a TXT record in DNS like this:

_acme-challenge.example.com TXT "long-random-string"

Add the record via your DNS control panel, wait 2-5 minutes for propagation, then press Enter.

Step 3: Verify Issuance

sudo certbot certificates

You should see the certificate with covered domains and expiry date.

Automatic Renewal Using DNS API

Why Manual Renewal Is a Problem

Let's Encrypt certificates expire every 90 days. If you rely on manual renewal, you will inevitably forget and HTTPS will break on your site. The solution: automate validation through a DNS API.

With Cloudflare DNS

Install the Certbot Cloudflare plugin:

sudo apt install python3-certbot-dns-cloudflare -y

Create the credentials file:

sudo mkdir -p /etc/letsencrypt && sudo nano /etc/letsencrypt/cloudflare.ini

Add:

dns_cloudflare_api_token = YOUR_API_TOKEN

Set permissions:

sudo chmod 600 /etc/letsencrypt/cloudflare.ini

Request the certificate automatically:

sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini -d "example.com" -d "*.example.com"

With Other DNS Providers

Certbot supports dozens of providers through DNS plugins. The most common:

Provider	Plugin
Cloudflare	python3-certbot-dns-cloudflare
Route53 (سحابة أمريكية)	python3-certbot-dns-route53
سحابة أمريكية DNS	python3-certbot-dns-google
مزود أجنبي	python3-certbot-dns-مزود أجنبي

Scheduling Automatic Renewal

Certbot automatically adds a cron job upon installation. Verify it:

sudo systemctl status certbot.timer

Or manually add to crontab:

0 3 * * * certbot renew --quiet --deploy-hook "systemctl reload nginx"

The --deploy-hook option reloads Nginx after each successful renewal so it uses the new certificate.

Configuring with Nginx

After issuing the certificate, update your Nginx configuration:

server {

listen 443 ssl http2;

server_name example.com *.example.com;

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

ssl_protocols TLSv1.2 TLSv1.3;

ssl_ciphers HIGH:!aNULL:!MD5;

}

Configuring with Apache

<VirtualHost *:443>

ServerName example.com

ServerAlias *.example.com

SSLEngine on

SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem

SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

</VirtualHost>

Common Errors and Solutions

Problem	Cause	Solution
DNS validation fails	TXT record has not propagated yet	Wait 5-10 minutes and try again
Too many requests error	Exceeded weekly issuance limit	Wait one week or use the staging environment
Certificate does not cover root domain	Requested *.example.com only	Add -d example.com -d "*.example.com"
Auto-renewal fails	API token permissions expired	Renew the token and update credentials file
Browser rejects certificate	Used cert.pem instead of fullchain.pem	Always use fullchain.pem (includes full chain)

Testing the Certificate

After installation, verify the setup:

• SSL Labs: https://www.ssllabs.com/ssltest/ — you should receive an A or A+ rating
• Command line: openssl s_client -connect example.com:443 -servername example.com
• Coverage check: Try opening https://any-subdomain.example.com and confirm the certificate is valid

Free Let's Encrypt Wildcard certificates are available on all CLOUD servers (cloud.net.sa). If you are running a server on CLOUD, the support team can assist with setup if needed. But with this guide, the setup should not take more than 15 minutes.

---

Get Started

Want to try it yourself? Choose the right hosting plan or build your custom server with the specs you need.