How to Get Free Wildcard SSL Certificates
Free wildcard SSL (Secure Sockets Layer) certificates protect your main domain and every subdomain underneath it with a single file. This setup keeps visitor data safe and adds a secure padlock icon to web browsers without costing any money.
Let’s Encrypt provides these certificates at no cost for anyone running an Ubuntu 24.04 server. You can set them up using Certbot, a free tool that handles automatic renewals every 90 days.
Install Certbot using apt-get, then run certbot certonly with manual and DNS challenge flags for your domain and its wildcard. You’ll add a TXT record to your DNS as prompted.
Install the Let’s Encrypt Certbot Tool
To generate your free wildcard certificates, ensure that Certbot is installed and running. Install it by running the commands below:
sudo apt update sudo apt-get install letsencrypt
Running the commands above installs the Certbot tool and its necessary dependencies.
Generate Let’s Encrypt Wildcard SSL Certificate
Free wildcard SSL certificates from Let’s Encrypt are generated using command-line tools like Certbot by completing a DNS verification step. You create a specific text record in your domain registrar’s DNS settings to prove you own the website before the tool requests and downloads your valid certificate files.
Let’s Encrypt requires domain ownership confirmation before issuing certificates. For wildcard certificates, Let’s Encrypt uses the DNS challenge method. Trigger this DNS challenge by using the `–preferred-challenges=dns` flag in the command.
To generate a wildcard cert for domain *.example.com, run the commands below. The bare domain should also be included when registering.
sudo certbot certonly --manual --preferred-challenges=dns --email admin@example.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d example.com -d *.example.com
The command options above are explained below:
- certonly: Obtain or renew a certificate, but do not install
- --manual: Obtain certificates interactively
- --preferred-challenges=dns: Use DNS to authenticate domain ownership
- --server: Specify the endpoint to use to generate
- --agree-tos: Agree to the ACME server's subscriber terms
- -d: Domain name to provide certificates for
After executing the command above, Let's Encrypt provides a text string to add a text record to your DNS entry.
Example:
Access your DNS provider's portal to add a TXT record for the domain validation string provided by Let's Encrypt. Saving this TXT record confirms you own the domain, allowing Let's Encrypt to issue your free wildcard SSL certificate.
Wait a few minutes before continuing from the prompt. DNS (Domain Name System) changes take a few minutes to propagate globally, depending on your host.
After making the changes above, when Let's Encrypt verifies that you own the domain, a successful message similar to the one below appears:
IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/example.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/example.com/privkey.pem Your cert will expire on 2020-01-09. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
The wildcard certificate is now generated and ready to be used.
To verify that the certificate is ready, run the commands below:
sudo certbot certificates
That displays a screen similar to the one below:
Let's Encrypt certificates are valid for 90 days. Automate certificate renewals or manually renew the certificate until a better management method exists.
You're all set.
Generating a free wildcard TLS (Transport Layer Security) certificate via Let's Encrypt boosts your site security.
- Generating a free wildcard SSL/TLS certificate using Let's Encrypt is a straightforward process that enhances your website's security.
- The Certbot tool simplifies the installation and management of SSL certificates through a fully automated system.
- Always keep your Certbot and certificates up to date to ensure continuous web security and functionality.
- Remember that your Let's Encrypt certificates will expire every 90 days, so set up reminders or automated renewal processes.
- Backing up your Certbot configuration directory is crucial for safeguarding your keys and certificates.
- Support the efforts of organizations like ISRG and EFF to maintain free encryption services for everyone.
Why is wildcard SSL so expensive?
Standard SSL certificates protect only one website. Wildcard SSL certificates, on the other hand, provide protection to the root domain as well as the subdomains. Wildcard certificates save hours of administrative overhead by replacing dozens of individual files.
Is SSL Starter Wildcard free?
For example, if you purchase a domain from IONOS, you'll receive an SSL Starter Wildcard certificate at no extra cost.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
Very nice and clear! Thank you very much for this post!
I followed this tutorial and got a successful cert… however, when going to the url for my website, it does not direct to https nor does it say secured when manually entering it as https.
I am running apache that this is being used on, is that why it’s not working? I figured this was a blanket cert for the website regardless of if it was ran by apache or something else?
Thank you!
I got the certificate installed already. What’s next to be configured? What will be the content of the virtual host file?
Great tutorial!!!
Well done
Thanks a lot for this, it was much easier than I thought. I now also understand cron jobs. Correct me if I am wrong but this one runs every day at 1am. And certbot will not renew if the certificate is not ready to be renewed.
Does the renewal actually work? Running a “sudo certbot renew –dry-run” gives the following error:
Cert not due for renewal, but simulating renewal for dry run
Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError(‘An authentication script must be provided with –manual-auth-hook when using the manual plugin non-interactively.’)
Attempting to renew cert (example.com) from /etc/letsencrypt/renewal/example.com.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError(‘An authentication script must be provided with –manual-auth-hook when using the manual plugin non-interactively.’). Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/example.com/fullchain.pem (failure)
Just for future reference, from what I understand this happens when the –manual flag is used when generating the certificate. I know this tutorial says “renew” works at the end, but it doesn’t if you use the -manual flag to create the certificate.
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Processing /etc/letsencrypt/renewal/.conf
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Cert is due for renewal, auto-renewing…
Could not choose appropriate plugin: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError(‘An authentication script must be provided with –manual-auth-hook when using the manual plugin non-interactively.’)
Attempting to renew cert () from /etc/letsencrypt/renewal/.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError(‘An authentication script must be provided with –manual-auth-hook when using the manual plugin non-interactively.’). Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live//fullchain.pem (failure)
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live//fullchain.pem (failure)
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
1 renew failure(s), 0 parse failure(s)
The most important part is missing, means how to link the certificate to your web server configuration. How about this ?
Do we need to install crontab if status of certbot.timer is active? I’m confuse with other website instruction.
I took a screenshot of your congratulations message. Please forgive me
Almost positive the auto-renew option via the cronjob is not valid (unless there’s a renew-hook script that configures the DNS for the wildcard domains). OR you connect to your DNS’ API plugin (I’ve read some safety concerns around this).
Decided on acme-dns as there are a few threads that recommend it to automate the process. A script to certbot seems like a good option for those technical enough to carry out.
It says right on the official certbot FAQ that a certificate obtained through the –manual option cannot be renewed with the renew command. You are supposed to use a script or some other automation technique for the renewal.