How to Issue a Wildcard Certificate using ACME DNS Challenge & API Token?

Wildcard certificates make SSL a breeze to manage. You can add one cert for all the subdomains under example.com, rather than having to add one certificate per subdomain.

The thing is, wildcard certificates must be validated with the DNS-01 challenge, and there is no HTTP-01 workaround. This requires you to create a DNS TXT record, and usually this will be done through your DNS provider’s API.

Here are four practical ways around the most-used ACME clients and platforms. Select the one that works for your stack.

Key Takeaways

• Only the ACME challenge type DNS-01 is supported. Only DNS-01 is a valid ACME challenge type.
• Always use example.com and *.example.com. Wildcard will not include the top-level domain
• Only use a scoped API token (DNS Edit only), not a full access global token
• Ensure that credential files are owned by root and have chmod 600 permissions.
• *.example.com is a single-level-deep domain. Only sub.app.example.com requires a cert of its own.
• Use –staging as a safety measure to prevent Let’s Encrypt rate limits.
• Unlike Certbot, acme.sh automatically generates a cron job; acme.sh relies on systemd timers or cron to make sure that renewal is properly configured

Method 1: acme.sh + Cloudflare (Linux / Self-Hosted)

Ideal for homelab, VPS and self-hosted configurations where you’re in control of the server.

1. Install acme.sh

curl https://get.acme.sh | sh
source ~/.bashrc

2. Cloudflare API credentials must be configured

Generate a Cloudflare API token using Zone → DNS → Edit permission and ensure it is a scoped API token that only restricts access to your zone. Then export:

export CF_Token="your_cloudflare_api_token"
export CF_Zone_ID="your_zone_id"

3. Assign the Wildcard Certificate

acme.sh --issue --dns dns_cf \
-d "example.com" \
-d ".example.com"

The _acme-challenge TXT record is automatically generated by acme.sh, awaits propagation, and is cleaned up after validation.

4. Install the certificate to a working location

mkdir -p /etc/ssl/private/example.com
acme.sh --install-cert -d "example.com" \
--key-file /etc/ssl/private/example.com/wildcard.key \
--fullchain-file /etc/ssl/private/example.com/wildcard.crt \
--reload command “systemctl reload nginx”

5. Check Autorenew Cron Job

To check if a cron job for acme exists, you can run:

acme.sh --renew -d mail.example.com --force

acme.sh will only renew when the cert is within 30 days of expiration.

Method 2: cPanel/WHM + acme.sh

This method is ideal for cPanel/WHM servers where AutoSSL is enabled but doesn’t support wildcard certificates.

1. Install acme.sh

curl https://get.acme.sh | sh -s [email protected] home=/opt/acme.sh

2. Configure Your DNS API

Add your DNS provider’s API credentials.

Cloudflare:

export CF_Token="your-api-token"
export CF_Zone_ID="your-zone-id"

WHM DNS:

export CPANEL_USERNAME="root"
export CPANEL_APITOKEN="your-whm-api-token"

3. Issue the Wildcard Certificate

/opt/acme.sh/acme.sh --issue \
-d example.com \
-d "*.example.com" \
--dns dns_cf

4. Deploy to cPanel

/opt/acme.sh/acme.sh --deploy \
-d example.com \
--deploy-hook cpanel_uapi \
--env DEPLOY_CPANEL_USER=cpuser

5. Prevent AutoSSL from Replacing It

Add your domain to the AutoSSL Exclusion List or run:

/usr/local/cpanel/bin/whmapi1 set_autossl_metadata \
provider=cPanel \
excluded_domains='["*.example.com","example.com"]'

6. Verify Auto-Renewal

crontab -l | grep acme

This confirms that acme.sh will renew your wildcard certificate automatically.

Method 3: Using Certbot + DNS Plugin

For those using Apache or Nginx, Certbot is one of the easiest programs to use to obtain and renew a wildcard SSL certificate. It has been tested on Ubuntu 20.04+, CentOS 7+, AlmaLinux, Rocky Linux, and RHEL.

1. Install Certbot

sudo apt update -y
sudo apt install certbot

2. Install the DNS Plugin, and you are done

Set up the domain name server (DNS) plugin for your DNS provider.

Cloudflare:

sudo apt install python3-certbot-dns-cloudflare -y

DigitalOcean:

sudo apt install python3-certbot-dns-digitalocean

Route 53:

sudo apt install python3-certbot-dns-route53

OVH:

sudo apt install python3-certbot-dns-ovh

3. Configure API Credentials

Generate required credentials file and secure it:

chmod 600 ~/.secrets/certbot/*.ini

4. Sign up for a Wildcard Certificate

Cloudflare:

sudo certbot --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini --dns-cloudflare-propagation-seconds 30 -d example.com -d "*.example.com"

Route 53:

sudo certbot certonly --dns-route53 -d example.com -d "*.example.com"

5. Set up your Web Server

If you’re using Nginx or Apache, add the appropriate installer flag:

--installer nginx

or

--installer apache

6. Test Auto-Renewal

Check that the certificate is automatically renewed before its expiration date.

sudo certbot renew --dry-run

Certbot will automatically generate a systemd timer or cron job to renew automatically in the future.

Method 4: Certbot + Azure DNS

This is the best way to do this when your domains are registered with Azure DNS, and you need to automate the creation of wildcard certificates.

1. Install Certbot and the Azure Plugin

sudo apt update
sudo apt install certbot
pip install certbot-dns-azure

2. Configure Azure Access

Set up a Service Principal with the role of DNS Zone Contributor, and store the credentials under:

/etc/letsencrypt/azure/credentials.ini

Secure the file:

chmod 600 /etc/letsencrypt/azure/credentials.ini

3. The Wildcard Certificate is issued

sudo certbot certonly \
--dns-azure \
--dns-azure-credentials /etc/letsencrypt/azure/credentials.ini \
-d example.com \
-d "*.example.com"

Alternative: Manual DNS Challenge

If you don’t wish to use the Azure API, then run:

sudo certonly --manual --preferred-challenges=dns \

The domain name is considered to be a wildcard. The domain name is treated as a wildcard.

A TXT record will be displayed by Certbot. Add it to your Azure DNS Zone, wait for the DNS propagation, and press Enter to validate.

Common Troubleshooting

If it is not possible to issue the certificate, consider the following:

• Make sure that you have the right permissions in your DNS API token.
• Before validation, ensure that the TXT record has propagated.
• Ensure you install the appropriate DNS plugin for your ACME client.
• Avoid rate limits by using the staging environment of Let’s Encrypt.
• Keep in mind that example.com is not included in *.example.com. Always use both domains.
•  If you’re using cPanel, you need to filter out wildcard domains from AutoSSL to avoid conflicts.

Conclusion

One of the most convenient ways to make managing certificates easier, while ensuring all your first-level subdomains are secured, is to use the ACME DNS challenge to issue a wildcard SSL certificate.

Regardless of your preferred option, the ultimate goal is to automate DNS validation renewals with your DNS provider’s API to minimise downtime and admin time.

If you’re looking for a trusted SSL certificate provider, our team can help. Our Automated SSL certificates are the best for your website or business and keep your domains secure and protected in shorter validity era.