Free Wildcard SSL Certificates with Let’s Encrypt
Free wildcard SSL certificates can secure your main domain and all its subdomains, such as blog.yourdomain.com and shop.yourdomain.com, with a single certificate.
Let’s Encrypt provides free, automated SSL certificates. These certificates encrypt connections to your website, which is important for keeping visitor data safe and building trust.
This guide shows you how to get a wildcard SSL certificate using Certbot on Ubuntu 24.04. Certbot automates the whole process of getting and renewing certificates, so your website always has a secure HTTPS connection.
Install Certbot using apt-get, then run certbot certonly with manual and DNS challenge flags for your domain and its wildcard. You’ll add a TXT record to your DNS as prompted.
Install the Let’s Encrypt Certbot Tool
To generate your free wildcard certificates, ensure that Certbot is installed and running. You can install it by running the commands below:
sudo apt update sudo apt-get install letsencrypt
Running the commands above installs the Certbot tool and its necessary dependencies.
Generate Let’s Encrypt Wildcard SSL Certificate
A free wildcard SSL certificate from Let’s Encrypt can be obtained using a command-line tool. Let’s Encrypt needs to prove you own your website, and for wildcard certificates, this usually involves using the DNS challenge. We’ll walk you through the steps to get your free wildcard SSL certificate.
Let’s Encrypt requires domain ownership confirmation before issuing certificates. For wildcard certificates, Let’s Encrypt uses the DNS challenge method. You will trigger this DNS challenge by using the `–preferred-challenges=dns` flag in the command.
So, to generate a wildcard cert for domain *.example.com, run the commands below. The bare domain should also be included when registering.
sudo certbot certonly --manual --preferred-challenges=dns --email admin@example.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d example.com -d *.example.comThe command options above are explained below:
- certonly: Obtain or renew a certificate, but do not install
- –manual: Obtain certificates interactively
- –preferred-challenges=dns: Use DNS to authenticate domain ownership
- –server: Specify the endpoint to use to generate
- –agree-tos: Agree to the ACME server’s subscriber terms
- -d: Domain name to provide certificates for
After executing the command above, Let’s Encrypt will provide a text string to add a text record to your DNS entry.
Example:
Access your DNS provider’s portal to add a TXT record for the domain validation string provided by Let’s Encrypt. Saving this TXT record confirms you own the domain, allowing Let’s Encrypt to issue your free wildcard SSL certificate.
Wait a few minutes before continuing from the prompt. Some DNS providers may take time to propagate changes, depending on your provider’s platform.
After making the changes above, when Let’s Encrypt verifies that you own the domain, a successful message similar to the one below should appear:
IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/example.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/example.com/privkey.pem Your cert will expire on 2020-01-09. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
The wildcard certificate is now generated and ready to be used.
To verify that the certificate is ready, run the commands below:
sudo certbot certificates
That should display a screen similar to the one below:
Let’s Encrypt certificates are valid for 90 days. Automate certificate renewals or manually renew the certificate until a better management method exists.
You’re all set.
Conclusion:
- Generating a free wildcard SSL/TLS certificate using Let’s Encrypt is a straightforward process that enhances your website’s security.
- The Certbot tool simplifies the installation and management of SSL certificates through a fully automated system.
- Always keep your Certbot and certificates up to date to ensure continuous web security and functionality.
- Remember that your Let’s Encrypt certificates will expire every 90 days, so set up reminders or automated renewal processes.
- Backing up your Certbot configuration directory is crucial for safeguarding your keys and certificates.
- Support the efforts of organizations like ISRG and EFF to maintain free encryption services for everyone.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
Very nice and clear! Thank you very much for this post!
I followed this tutorial and got a successful cert… however, when going to the url for my website, it does not direct to https nor does it say secured when manually entering it as https.
I am running apache that this is being used on, is that why it’s not working? I figured this was a blanket cert for the website regardless of if it was ran by apache or something else?
Thank you!
I got the certificate installed already. What’s next to be configured? What will be the content of the virtual host file?
Great tutorial!!!
Well done
Thanks a lot for this, it was much easier than I thought. I now also understand cron jobs. Correct me if I am wrong but this one runs every day at 1am. And certbot will not renew if the certificate is not ready to be renewed.
Does the renewal actually work? Running a “sudo certbot renew –dry-run” gives the following error:
Cert not due for renewal, but simulating renewal for dry run
Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError(‘An authentication script must be provided with –manual-auth-hook when using the manual plugin non-interactively.’)
Attempting to renew cert (example.com) from /etc/letsencrypt/renewal/example.com.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError(‘An authentication script must be provided with –manual-auth-hook when using the manual plugin non-interactively.’). Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/example.com/fullchain.pem (failure)
Just for future reference, from what I understand this happens when the –manual flag is used when generating the certificate. I know this tutorial says “renew” works at the end, but it doesn’t if you use the -manual flag to create the certificate.
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Processing /etc/letsencrypt/renewal/.conf
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Cert is due for renewal, auto-renewing…
Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError(‘An authentication script must be provided with –manual-auth-hook when using the manual plugin non-interactively.’)
Attempting to renew cert () from /etc/letsencrypt/renewal/.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError(‘An authentication script must be provided with –manual-auth-hook when using the manual plugin non-interactively.’). Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live//fullchain.pem (failure)
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live//fullchain.pem (failure)
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
1 renew failure(s), 0 parse failure(s)
The most important part is missing, means how to link the certificate to your web server configuration. How about this ?
Do we need to install crontab if status of certbot.timer is active? I’m confuse with other website instruction.
I took a screenshot of your congratulations message. Please forgive me
Almost positive the auto-renew option via the cronjob is not valid (unless there’s a renew-hook script that configures the DNS for the wildcard domains). OR you connect to your DNS’ API plugin (I’ve read some safety concerns around this).
Decided on acme-dns as there are a few threads that recommend it to automate the process. A script to certbot seems like a good option for those technical enough to carry out.
It says right on the official certbot FAQ that a certificate obtained through the –manual option cannot be renewed with the renew command. You are supposed to use a script or some other automation technique for the renewal.