Skip to main content
Certificate issuance

Request a Wildcard SSL Certificate

Request and validate a wildcard SSL certificate, understand its domain coverage, and configure automated renewal.

CertOne4 min read

A wildcard SSL certificate covers matching subdomains at one level. For example, *.example.com covers www.example.com, api.example.com, and blog.example.com, but not example.com itself. This guide covers requests, DNS validation, deployment, and operational considerations.

1. What Is a Wildcard Certificate?​

1. Definition​

A wildcard name uses an asterisk to match one subdomain label, such as *.example.com.

2. Coverage​

Covered:

  • ✅ www.example.com
  • ✅ api.example.com
  • ✅ blog.example.com
  • ✅ shop.example.com
  • ✅ Any matching first-level subdomain

Not covered by the wildcard name alone:

  • ❌ example.com, the apex domain
  • ❌ sub.www.example.com, a deeper subdomain

3. Benefits of Wildcard Certificates​

  • ✅ Covers matching subdomains at one level
  • ✅ New matching subdomains need no reissuance
  • ✅ One certificate to manage
  • ✅ Useful for many subdomains

2. Application Requirements​

1. Validation Method​

Let's Encrypt wildcard requests require DNS validation:

  • HTTP validation cannot be used for these wildcard requests.
  • A DNS TXT challenge record must be published, directly or through delegated validation.
  • Prove control of the parent domain's DNS

2. Certificate Authorities​

Free wildcard certificates:

  • Let's Encrypt through CertOne, acme.sh, or another ACME client
  • FreeSSL.cn

Commercial wildcard certificates:

  • DigiCert
  • Sectigo
  • GlobalSign
  • Other commercial CAs

3. Certificate types​

Wildcard certificates are available as DV certificates, and some CAs also offer OV wildcard products:

  • OV wildcard availability depends on the certificate authority and product.
  • EV certificates do not support wildcard domain names.

3. Request a Free Wildcard Certificate in CertOne​

1. Create a request​

  1. Sign in to CertOne
  2. Open Certificates
  3. Click Create certificate
  4. Select DNS authorization or CNAME validation.

2. Enter domain details​

  • Certificate name: Enter a descriptive name.
  • Domain: Enter the wildcard name, such as *.example.com.
  • Add the apex domain separately if you also need to cover example.com.

3. DNS Validation​

DNS authorization:

  1. Select a DNS authorization
  2. The system creates the DNS validation records automatically.
  3. Wait for validation to complete.

CNAME validation:

  1. The system displays the required CNAME record.
  2. Add the CNAME record at your DNS provider.
  3. Wait for DNS propagation
  4. CertOne checks the records

4. Wait for issuance​

After validation succeeds, the system requests the certificate automatically:

  • Usually completes within minutes
  • 90-day certificate validity
  • Automatic renewal is available

4. Request a Wildcard Certificate with acme.sh​

1. Install acme.sh​

curl https://get.acme.sh | sh

2. Configure the DNS API​

The following example uses Cloudflare:

export CF_Email="your-email@example.com"
export CF_Key="your-api-key"

3. Request the Wildcard Certificate​

~/.acme.sh/acme.sh --issue -d "*.example.com" --dns dns_cf

4. Install the certificate​

~/.acme.sh/acme.sh --install-cert -d "*.example.com" \
  --key-file /path/to/key.pem \
  --fullchain-file /path/to/fullchain.pem \
  --reloadcmd "systemctl reload nginx"

5. Request a Wildcard Certificate with Certbot​

1. Install Certbot​

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install certbot

# Install the DNS plugin, using Cloudflare as an example
sudo apt-get install python3-certbot-dns-cloudflare

2. Configure DNS Credentials​

Create /etc/letsencrypt/cloudflare.ini:

dns_cloudflare_email = your-email@example.com
dns_cloudflare_api_key = your-api-key

Set the file permissions:

sudo chmod 600 /etc/letsencrypt/cloudflare.ini

3. Request the Wildcard Certificate​

sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d "*.example.com"

4. Configure automatic renewal​

sudo certbot renew --dry-run

6. Configure the Wildcard Certificate​

1. NGINX configuration​

server {
    listen 443 ssl;
    server_name *.example.com;
    
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    
    # Add the remaining site configuration here.
}

2. Apache configuration​

<VirtualHost *:443>
    ServerName *.example.com
    SSLEngine on
    
    SSLCertificateFile /path/to/cert.pem
    SSLCertificateKeyFile /path/to/private.key
    SSLCertificateChainFile /path/to/chain.pem
</VirtualHost>

3. Include the Apex Domain​

To cover both the apex domain and matching subdomains:

Option 1: Include both names in one certificate

  • Request a certificate containing example.com and *.example.com.

Option 2: Use two certificates

  • Use a single-domain certificate for example.com.
  • Use a wildcard certificate for *.example.com.

7. Common Use Cases​

1. SaaS Platforms​

Scenario:

  • Assign a subdomain to each customer.
  • Examples: client1.example.com and client2.example.com

Advantages:

  • One wildcard certificate can cover matching customer subdomains.
  • Adding a matching subdomain does not require certificate reissuance.

2. Multiple Services​

Scenario:

  • Assign different subdomains to different services.
  • Examples: api.example.com, www.example.com, and admin.example.com

Advantages:

  • Manage renewal centrally
  • Simplify certificate configuration.

3. Development and Test Environments​

Scenario:

  • Use different subdomains for development environments.
  • Examples: dev.example.com, test.example.com, and staging.example.com

Advantages:

  • A wildcard certificate can cover matching environment names.
  • Simplify management and deployment.

8. Operational Considerations​

1. Security​

Private key protection:

  • Protect the wildcard certificate's private key carefully.
  • A compromised key affects every hostname covered by that certificate.
  • Store the key securely.

Access control:

  • Restrict access to certificate and private key files.
  • Apply appropriate file permissions.
  • Rotate certificates and keys as required.

2. Coverage Limitations​

Only one subdomain level is matched:

  • *.example.com does not cover sub.www.example.com.
  • Add separate names or an appropriate wildcard for deeper subdomains.

The apex domain is not included automatically:

  • *.example.com does not cover example.com.
  • Include the apex explicitly if needed

3. Certificate renewal​

Automatic renewal:

  • Use CertOne or acme.sh to automate renewal.
  • Renew certificates before they expire.

DNS validation:

  • Renewal must satisfy the CA's DNS validation requirements.
  • DNS API authorization automates this process
  • With CertOne CNAME validation, keep the delegated CNAME record in place so subsequent validations can run automatically.

9. Common questions​

1. The Apex Domain Is Not Covered​

Issue: *.example.com does not cover example.com.

Resolution:

  • Request a certificate that explicitly includes the apex domain.
  • Alternatively, use a separate certificate for each requirement.

2. DNS Validation Fails​

Possible causes:

  • DNS changes have not propagated
  • The DNS record has an incorrect format.
  • Validation timed out

Resolution:

  • Check the record name and value
  • Wait for propagation
  • Use DNS authorization to automate record management.

3. The Installed Certificate Is Not Served​

Possible causes:

  • Incorrect certificate configuration
  • Server configuration
  • Incomplete certificate chain

Resolution:

  • Check the certificate configuration
  • Check server settings
  • Use the full-chain file

Conclusion​

Wildcard certificates are useful for services with many matching subdomains, including SaaS platforms and multi-service deployments. CertOne, acme.sh, and Certbot can automate their issuance and management.

Key points:

  • ✅ Let's Encrypt wildcard requests require DNS validation.
  • ✅ A wildcard matches one subdomain level.
  • ✅ Add the apex domain separately if required.
  • ✅ Protect the private key carefully.
  • ✅ Use automation to manage renewal and deployment.

CertOne provides a web interface and automation features for requesting, renewing, and deploying wildcard certificates.