How to Set Up a Wildcard Certificate With DNS Validation

Unlike a single-domain certificate, a wildcard certificate can only be validated via DNS — there's no HTTP-based validation option, because there's no single file path that could prove control over every possible subdomain a wildcard might cover.

The process with Certbot

certbot certonly --manual --preferred-challenges dns \
  -d yourdomain.com -d '*.yourdomain.com'

Certbot will provide a specific DNS TXT record value to add at _acme-challenge.yourdomain.com. Add it through your DNS provider, wait for it to propagate, then confirm in Certbot to complete issuance. For automated (non-manual) renewal of a wildcard certificate, you'll need a DNS provider with API support and a compatible Certbot DNS plugin, since the manual process requires interactive action each time.

Renewal considerations

Because wildcard certificates require DNS validation on every renewal, automating this properly (rather than doing it manually every 90 days with Let's Encrypt) generally requires your DNS provider to support API-based record management and a corresponding Certbot DNS plugin for that specific provider.

What to do if your DNS provider's API isn't supported by your ACME client

If your specific DNS provider lacks a dedicated plugin, some ACME clients support a generic manual mode where you add the required TXT record yourself when prompted — slower and less automatable than a native plugin, but functional for any DNS provider regardless of dedicated automation support.

How to verify a DNS TXT record has in practice propagated before the CA checks it

Querying a public DNS resolver directly (`dig TXT _acme-challenge.yourdomain.com @8.8.8.8`) rather than your own local resolver confirms the record is visible from outside your own network, since a CA's validation server queries independently and won't see a record still cached locally but not yet propagated more broadly.

What happens if you need both a wildcard and the root domain covered together

Requesting both yourdomain.com and *.yourdomain.com together in a single certificate request (most ACME clients support specifying multiple domains in one command) ensures both the root domain and every subdomain are covered by a single certificate rather than needing two separate ones.

How DNS validation differs in setup complexity across major DNS providers

DNS providers with a well-documented, stable API (Cloudflare, Route 53, and others) generally have mature, reliable ACME client plugins, while smaller or less API-friendly providers may require the slower, more manual DNS validation mode covered elsewhere in this guide — worth factoring into a DNS provider choice if wildcard certificate automation matters to you.

Why some organizations use a dedicated DNS validation subdomain to limit API credential scope

Creating a dedicated subdomain with its own more narrowly scoped DNS API credentials, used exclusively for ACME validation records, limits the potential damage if those specific credentials were ever compromised, compared to using broader, full-zone DNS API credentials for the same purpose.

What to do if your ACME client reports success but the wildcard certificate seems incomplete

If issuance reports success but the certificate doesn't seem to cover every expected subdomain, checking the certificate's actual SAN field immediately (rather than assuming based on your request) confirms exactly what was issued — occasionally a request only partially matches what was intended due to a syntax issue in how the domains were specified.

How to renew a wildcard certificate without repeating the entire manual DNS process each time

Using an ACME client with a supported DNS provider plugin, rather than manual DNS record management, automates wildcard renewal completely — the manual DNS-01 process covered as a fallback in this guide is only necessary when no plugin exists for your specific DNS provider.

A closing note on wildcard certificates as a genuine convenience worth the extra validation step

The extra DNS validation step this guide walks through is a small, one-time or automatable cost for the ongoing convenience a wildcard certificate provides — coverage that automatically extends to any future subdomain without needing a separate certificate request each time.