How to Install Wildcard Let's Encrypt SSL on Ubuntu Server That Auto-Renews

A Wildcard SSL Certificate is a single, powerful SSL/TLS certificate that secures both your root domain (domain.com) and any current or future subdomain (*.domain.com, such as app.domain.com, api.domain.com, blog.domain.com, or shop.domain.com). For developers building SaaS platforms, multi-tenant architectures, agency client portals, or microservices, Wildcard SSL eliminates the need to generate and manage separate certificates for every new subdomain.

Unlike standard SSL certificates which verify domain ownership via HTTP file challenges (HTTP-01), Let’s Encrypt strictly mandates the DNS-01 verification challenge for all Wildcard certificates. This requires creating a special _acme-challenge DNS TXT record.

In this comprehensive guide, we will walk you through installing an automatically renewing Wildcard Let’s Encrypt SSL certificate on Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 20.04 LTS using Certbot and automated DNS plugins for 100% hands-off auto-renewal.

Prerequisites

• An active Linux Virtual Private Server (VPS) running Ubuntu (26.04, 24.04, 22.04, or 20.04 LTS).
• SSH access with sudo or root privileges (see How to Log in and Access Ubuntu Server via SSH and How to Create a Sudo User on Ubuntu).
• Nginx or Apache web server installed and running (see How to Set Up Nginx on Ubuntu Server).
• UFW firewall configured (see How to Configure UFW Firewall on Ubuntu).
• A registered domain name pointing its root and wildcard DNS A Record (* and @) to your VPS IP address (refer to How to Point Your Domain to a VPS IP Address).
• DNS managed by a provider supporting API authentication (e.g. Cloudflare, RFC2136, DigitalOcean, Route53) or access to add manual DNS TXT records.
• Looking for standard single-domain SSL? See our guide on How to Install Let's Encrypt SSL on Ubuntu Server.

Understanding the Challenge: Why Wildcard Auto-Renewal Requires DNS API

Because Let’s Encrypt certificates expire every 90 days, manual DNS TXT record verification will break automated renewals. To make Wildcard SSL automatically renew in the background without human intervention, Certbot must communicate directly with your DNS provider via an API plugin to add and remove the required TXT verification token dynamically.

Below, we cover Method 1 (Fully Automated via Cloudflare DNS Plugin – Recommended) and Method 2 (Manual DNS Verification).

Method 1: Fully Automated Wildcard SSL via Cloudflare DNS API (Recommended)

Cloudflare provides free DNS management and a secure API token system, making it the most popular and reliable choice for automated Wildcard SSL certificates.

Step 1: Create a Cloudflare DNS API Token

1. Log in to your Cloudflare Dashboard and navigate to My Profile > API Tokens.
2. Click Create Token > find the template Edit zone DNS and click Use template.
3. Under Zone Resources, select Include > Specific zone > choose your domain name (e.g. domain.com).
4. Click Continue to summary > click Create Token.
5. Copy the generated API Token (save it temporarily, as it is only displayed once).

Step 2: Install Certbot and the Cloudflare DNS Plugin via Snap

The Electronic Frontier Foundation (EFF) officially packages DNS plugins for Certbot via Snap:

# Ensure Certbot is installed via snap
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

# Allow Certbot to use snap plugins
sudo snap set certbot trust-plugin-with-root=ok

# Install the Cloudflare DNS plugin
sudo snap install certbot-dns-cloudflare

Step 3: Securely Store Your DNS API Credentials on Ubuntu

1. Create a secure directory and credentials file:

   sudo mkdir -p /etc/letsencrypt
   sudo nano /etc/letsencrypt/cloudflare.ini

2. Paste your API token into the file:

   # Cloudflare API token used by Certbot
   dns_cloudflare_api_token = YOUR_CLOUDFLARE_API_TOKEN_HERE

3. Save and exit (CTRL + O, ENTER, CTRL + X).
4. CRITICAL: Restrict file permissions so that only the root user can read your API secret:

   sudo chmod 600 /etc/letsencrypt/cloudflare.ini

Step 4: Request the Wildcard SSL Certificate

Run the Certbot command requesting both your base domain and the wildcard subdomain (replace domain.com with your actual domain):

sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  --dns-cloudflare-propagation-seconds 30 \
  -d domain.com \
  -d *.domain.com \
  -m [email protected] \
  --agree-tos \
  --no-eff-email

Certbot will automatically connect to Cloudflare, create the temporary TXT challenge records, verify domain ownership with Let’s Encrypt, delete the temporary TXT records, and save your new Wildcard SSL certificate files:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/domain.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/domain.com/privkey.pem
This certificate expires on 2026-11-28.

Step 5: Verify Automated SSL Renewal

Certbot automatically configures a background systemd timer (snap.certbot.renew.timer) that executes twice daily. Test the automated renewal pipeline with a dry run:

sudo certbot renew --dry-run

You should see: "Congratulations, all simulated renewals succeeded".

Method 2: Manual Wildcard SSL (For Providers Without API Access)

If your DNS provider does not offer API automation, you can obtain a Wildcard certificate by manually creating the TXT record in your DNS manager:

1. Run the manual DNS challenge command:

   sudo certbot certonly --manual --preferred-challenges dns -d domain.com -d *.domain.com

2. Certbot will prompt you to create a DNS TXT record:
   • Host / Record Name: _acme-challenge.domain.com
   • Record Type: TXT
   • Value / Content: (The random string provided by Certbot, e.g. W3Xk...abc9)
3. Add the TXT record in your DNS management portal and wait 1–2 minutes for propagation.
4. Press ENTER in your terminal to complete verification.

Note: With manual verification, you will need to re-run this command every 60–90 days to renew your certificate.

Step 6: Configure Nginx to Use Your Wildcard SSL Certificate

Now that your Wildcard certificate is generated, update your Nginx server block configuration to serve all subdomains over HTTPS:

1. Open your Nginx configuration file:

   sudo nano /etc/nginx/sites-available/domain.com

2. Paste the following production Wildcard configuration:

   # 1. Redirect all HTTP traffic to HTTPS
   server {
       listen 80;
       listen [::]:80;
       server_name domain.com *.domain.com;
       return 301 https://$host$request_uri;
   }
   
   # 2. Wildcard HTTPS Server Block
   server {
       listen 443 ssl http2;
       listen [::]:443 ssl http2;
       server_name domain.com *.domain.com;
   
       root /var/www/domain.com/html;
       index index.html index.htm index.php;
   
       # Wildcard SSL Certificates
       ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
       ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
   
       # Modern SSL Security Configuration
       ssl_protocols TLSv1.2 TLSv1.3;
       ssl_prefer_server_ciphers on;
       ssl_ciphers HIGH:!aNULL:!MD5;
   
       location / {
           try_files $uri $uri/ /index.html;
       }
   
       access_log /var/log/nginx/domain.com.access.log;
       error_log /var/log/nginx/domain.com.error.log;
   }

3. Test Nginx configuration syntax:

   sudo nginx -t

4. Reload Nginx:

   sudo systemctl reload nginx

Step 7: Automatic Web Server Reload on Renewal (Deploy Hook)

To ensure that Nginx automatically reloads the newly renewed certificate without requiring a manual server restart, add a Certbot renewal hook:

echo '#!/bin/sh
systemctl reload nginx' | sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

Frequently Asked Questions & Troubleshooting

Q: Does a wildcard *.domain.com certificate cover multi-level subdomains like sub.app.domain.com?
A: No. In accordance with the X.509 SSL standard, a wildcard asterisk only matches one subdomain level. If you need multi-level subdomains, you can include them explicitly in your Certbot command: -d domain.com -d *.domain.com -d *.app.domain.com.

Q: Why does the Cloudflare DNS plugin fail with "Authentication error"?
A: Double-check that your API Token has Zone.DNS:Edit permissions for your specific domain and that you did not accidentally paste your Global API Key instead of an API Token.

Q: How can I verify that my subdomains are working with SSL?
A: Open any subdomain in your browser (e.g. https://api.domain.com or https://test.domain.com) and click the padlock icon to verify that the certificate issuer is Let’s Encrypt and the Common Name covers *.domain.com.

Need Further Assistance?

If you encounter any issues setting up Wildcard Let’s Encrypt SSL certificates, configuring DNS API tokens, or troubleshooting Nginx server blocks on your Ubuntu VPS, our technical support team is available 24/7. Feel free to submit a support ticket through your client area for expert guidance.