How to change existing certbot/nginx to wildcard domain?

Heya, @edwardsitarski

To use a wildcard cert (*.example.com) with Let’s Encrypt, you must switch from the HTTP challenge to the DNS-01 challenge (wildcards can’t be issued via HTTP-01), so you’ll be proving domain control by creating a TXT record in DNS.

1. Issue the wildcard cert (includes apex too):

sudo certbot certonly --manual --preferred-challenges dns \
  -d example.com -d '*.example.com'

Certbot will print a _acme-challenge.example.com TXT value to add in your DNS. Create it, wait for DNS to propagate, then continue.

If your DNS provider is supported, use a DNS plugin instead (recommended) so renewals are automatic, e.g. Cloudflare:

sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials /root/cf.ini \
  -d example.com -d '*.example.com'

2. Point Nginx at the new cert (usually under /etc/letsencrypt/live/example.com/):

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

Then:

sudo nginx -t && sudo systemctl reload nginx

3. Renewal: wildcard renewals also require DNS-01. If you used --manual, renewals won’t be hands-off. Use a DNS plugin (or something like acme.sh with DNS API) if you want “set and forget”.

Note: wildcard covers tenant.example.com, but not deeper like a.b.example.com (you’d need *.b.example.com for that).

Hope that this helps!

Heya,

you can’t convert an existing HTTP-based Certbot cert into a wildcard. You issue a new wildcard certificate, switch Nginx to it, and you’re done.

1. Issue a new wildcard cert

   • Use Certbot with --dns-* (depends on your DNS provider).

   • Example intent (not exact command): “Give me a cert for example.com and *.example.com using DNS validation.”

2. Verify via DNS

   • Certbot will either:

     • Automatically add/remove DNS records (best case), or

     • Ask you to manually add a TXT record once (still fine).

3. Update Nginx

   • Point your ssl_certificate and ssl_certificate_key to the new wildcard cert.

   • Reload Nginx.

4. Stop caring about subdomains

   • New tenant? Just add DNS → done. No more Certbot runs per client.

---

Renewal

• If DNS is automated → renewals are automatic.

• If DNS is manual → you’ll need to repeat the TXT step on renewal (every ~90 days).

sudo apt install python3-certbot-dns-cloudflare