AutoSSL Wildcard DNS Validation

Wildcard certificates must use DNS validation. They cannot be issued with the one-key HTTP deploy command, Nginx plugin, Apache plugin, or webroot validation.

Use this guide when the certificate contains a wildcard name such as:

example.com
*.example.com

Choose a Method

Use DNS API if you want automatic renewal. This is the recommended method for production wildcard certificates.

Use manual DNS only when your DNS provider has no supported API or you are testing. Manual DNS requires you to update TXT records again during renewal, so it is not a good long-term automation path.

Before You Start

Prepare the AutoSSL ACME details from your order:

Server URL: https://acme.sectigo.com/v2/DV
ACME account ID / EAB MAC ID: your ID
EAB MAC key: your key

Confirm the domain is managed by the DNS provider you will use. For *.example.com, you need permission to create TXT records under example.com.

Cloudflare DNS API

This example uses Certbot with Cloudflare DNS. It issues a wildcard certificate and saves it under /etc/sectigo.

1. Create a Cloudflare API Token

In Cloudflare, create an API token with access to the DNS zone:

Zone -> DNS -> Edit
Zone -> Zone -> Read

Limit the token to the specific zone, for example example.com.

2. Install Certbot and the DNS Plugin

Ubuntu/Debian:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-dns-cloudflare

RHEL / AlmaLinux / Rocky / CentOS:

sudo dnf install -y epel-release || sudo yum install -y epel-release
sudo dnf install -y certbot python3-certbot-dns-cloudflare || sudo yum install -y certbot python3-certbot-dns-cloudflare

3. Save the DNS API Token

sudo mkdir -p /etc/sectigo/dns
sudo tee /etc/sectigo/dns/cloudflare.ini >/dev/null <<'EOF'
dns_cloudflare_api_token = YOUR_CLOUDFLARE_API_TOKEN
EOF
sudo chmod 600 /etc/sectigo/dns/cloudflare.ini

4. Issue the Wildcard Certificate

Replace the values before running:

sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/sectigo/dns/cloudflare.ini \
  --dns-cloudflare-propagation-seconds 60 \
  --config-dir /etc/sectigo \
  --work-dir /var/lib/sectigo \
  --logs-dir /var/log/sectigo \
  --non-interactive \
  --agree-tos \
  --register-unsafely-without-email \
  --server "https://acme.sectigo.com/v2/DV" \
  --eab-kid "YOUR_ACME_ACCOUNT_ID_OR_EAB_MAC_ID" \
  --eab-hmac-key "YOUR_EAB_MAC_KEY" \
  --domain "example.com" \
  --domain "*.example.com" \
  --cert-name "example.com"

Certificate files:

/etc/sectigo/live/example.com/fullchain.pem
/etc/sectigo/live/example.com/privkey.pem

5. Install the Certificate in Your Web Server

For Nginx, add or update:

ssl_certificate     /etc/sectigo/live/example.com/fullchain.pem;
ssl_certificate_key /etc/sectigo/live/example.com/privkey.pem;

Then reload:

sudo nginx -t
sudo systemctl reload nginx

For Apache, add or update:

SSLCertificateFile /etc/sectigo/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/sectigo/live/example.com/privkey.pem

Then reload:

sudo apachectl configtest
sudo systemctl reload apache2 || sudo systemctl reload httpd

Managed Mode

If you want 12SSL to manage wildcard certificate issuance, renewal, and deployment for you, use managed mode.

In this mode, the certificate management server handles:

• Requesting and renewing certificates automatically
• Creating _acme-challenge TXT validation records through the DNS API
• Tracking certificate status, expiry dates, and renewal results
• Deploying renewed certificates to the selected servers
• Keeping renewal and deployment status records for troubleshooting

The ACME details and certificate status from the order are stored by the system and shown on the certificate page. For managed DNS validation and deployment, you only need to provide the additional details below:

DNS provider type
DNS zone
DNS API token
Deployment target server details

The DNS API token should be limited to DNS record editing for the specific zone. We do not recommend asking for, or storing, the DNS account login password.

If the certificate needs to be deployed to multiple servers, each deployment target also needs server details such as hostname, web server type, certificate paths, and reload method. For environments with stricter security requirements, a client agent or restricted SSH key can be used so the private key stays on your server.

Automatic Renewal

Create the same renewal timer used by the one-key deploy tool:

sudo tee /etc/systemd/system/sectigo-certbot-renew.service >/dev/null <<'EOF'
[Unit]
Description=Renew Sectigo AutoSSL certificates with Certbot

[Service]
Type=oneshot
ExecStart=/bin/bash -lc 'certbot renew --config-dir /etc/sectigo --work-dir /var/lib/sectigo --logs-dir /var/log/sectigo --quiet'
EOF

sudo tee /etc/systemd/system/sectigo-certbot-renew.timer >/dev/null <<'EOF'
[Unit]
Description=Daily Sectigo AutoSSL certificate renewal

[Timer]
OnCalendar=*-*-* 03:18:00
RandomizedDelaySec=2h
Persistent=true

[Install]
WantedBy=timers.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now sectigo-certbot-renew.timer

When the DNS API token remains valid, renewal should not require manual action.

Manual DNS Validation

Use this only if you cannot use a DNS API.

sudo certbot certonly \
  --manual \
  --preferred-challenges dns \
  --config-dir /etc/sectigo \
  --work-dir /var/lib/sectigo \
  --logs-dir /var/log/sectigo \
  --agree-tos \
  --register-unsafely-without-email \
  --server "https://acme.sectigo.com/v2/DV" \
  --eab-kid "YOUR_ACME_ACCOUNT_ID_OR_EAB_MAC_ID" \
  --eab-hmac-key "YOUR_EAB_MAC_KEY" \
  --domain "example.com" \
  --domain "*.example.com" \
  --cert-name "example.com"

Certbot will show one or more TXT records like:

_acme-challenge.example.com

Add the TXT record in your DNS provider, wait for DNS propagation, then continue the Certbot prompt.

Manual DNS is not recommended for unattended renewal because the TXT value changes during renewal.

Common Problems

• TXT record not found: wait longer for DNS propagation, or check that the record is in the authoritative DNS provider.
• Wrong DNS zone: for *.example.com, the TXT record is usually _acme-challenge.example.com, not _acme-challenge.*.example.com.
• Renewal fails later: use a DNS API token and make sure it has permission to edit TXT records.
• Certificate issued but site still shows old SSL: update the web server SSL file paths and reload the web server.