{"id":3342,"date":"2026-09-03T07:35:58","date_gmt":"2026-09-03T07:35:58","guid":{"rendered":"https:\/\/certera.com\/kb\/?p=3342"},"modified":"2026-09-03T07:36:01","modified_gmt":"2026-09-03T07:36:01","slug":"how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token","status":"publish","type":"post","link":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/","title":{"rendered":"How to Issue a Wildcard Certificate using ACME DNS Challenge &amp; API Token?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/certera.com\/ssl-types\/wildcard-ssl-certificates\">Wildcard certificates<\/a> make SSL a breeze to manage. You can add one cert for all the subdomains under example.com, rather than having to add one certificate per subdomain. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The thing is<\/strong>,&nbsp;wildcard certificates must be validated with the DNS-01 challenge, and there is no HTTP-01 workaround. This requires you to create a DNS TXT record, and usually this will be done through your DNS provider&#8217;s API.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are four practical ways around the <a href=\"https:\/\/certera.com\/blog\/what-are-acme-clients-what-are-the-most-widely-used-acme-clients\/\">most-used ACME clients<\/a> and platforms. Select the one that works for your stack.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Only the ACME challenge type DNS-01 is supported. Only DNS-01 is a valid ACME challenge type.<\/li>\n\n\n\n<li>Always use example.com and *.example.com. Wildcard will not include the top-level domain<\/li>\n\n\n\n<li>Only use a scoped API token (DNS Edit only), not a full access global token<\/li>\n\n\n\n<li>Ensure that credential files are owned by root and have chmod 600 permissions.<\/li>\n\n\n\n<li>*.example.com is a single-level-deep domain. Only sub.app.example.com requires a cert of its own.<\/li>\n\n\n\n<li>Use &#8211;staging as a safety measure to prevent Let&#8217;s Encrypt rate limits.<\/li>\n\n\n\n<li>Unlike Certbot, acme.sh automatically generates a cron job; acme.sh relies on systemd timers or cron to make sure that renewal is properly configured<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Method 1: acme.sh + Cloudflare (Linux \/ Self-Hosted)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ideal for homelab, VPS and self-hosted configurations where you&#8217;re in control of the server.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Install acme.sh<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code><em>curl https:\/\/get.acme.sh | sh<\/em>\n<em>source ~\/.bashrc<\/em><\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">2. Cloudflare API credentials must be configured<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Generate a Cloudflare API token using <strong>Zone \u2192 DNS \u2192 Edit permission <\/strong>and ensure it is a scoped API token that only restricts access to your zone. <strong>Then export:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>export CF_Token=\"your_cloudflare_api_token\"\nexport CF_Zone_ID=\"your_zone_id\"<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">3. Assign the Wildcard Certificate<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>acme.sh --issue --dns dns_cf \\\n-d \"example.com\" \\\n-d \".example.com\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <strong>_acme-challenge TXT record<\/strong> is automatically generated by acme.sh, awaits propagation, and is cleaned up after validation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Install the certificate to a working location<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir -p \/etc\/ssl\/private\/example.com\nacme.sh --install-cert -d \"example.com\" \\\n--key-file \/etc\/ssl\/private\/example.com\/wildcard.key \\\n--fullchain-file \/etc\/ssl\/private\/example.com\/wildcard.crt \\\n--reload command \u201csystemctl reload nginx\u201d<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">5. Check Autorenew Cron Job<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To check if a cron job for acme exists, you can run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>acme.sh --renew -d mail.example.com --force<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">acme.sh will only renew when the cert is within 30 days of expiration.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Method 2: cPanel\/WHM + acme.sh<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This method is ideal for <a href=\"https:\/\/certera.com\/kb\/how-to-install-sectigo-acme-ssl-certificates-on-cpanel-whm-using-certbot\/\">cPanel\/WHM servers<\/a> where AutoSSL is enabled but doesn&#8217;t support wildcard certificates.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Install acme.sh<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>curl https:\/\/get.acme.sh | sh -s email=admin@example.com home=\/opt\/acme.sh<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">2. Configure Your DNS API<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Add your DNS provider&#8217;s API credentials.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Cloudflare:<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>export CF_Token=\"your-api-token\"\nexport CF_Zone_ID=\"your-zone-id\"<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">WHM DNS:<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>export CPANEL_USERNAME=\"root\"\nexport CPANEL_APITOKEN=\"your-whm-api-token\"<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">3. Issue the Wildcard Certificate<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>\/opt\/acme.sh\/acme.sh --issue \\\n-d example.com \\\n-d \"*.example.com\" \\\n--dns dns_cf<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">4. Deploy to cPanel<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>\/opt\/acme.sh\/acme.sh --deploy \\\n-d example.com \\\n--deploy-hook cpanel_uapi \\\n--env DEPLOY_CPANEL_USER=cpuser<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">5. Prevent AutoSSL from Replacing It<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Add your domain to the AutoSSL Exclusion List or run:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/local\/cpanel\/bin\/whmapi1 set_autossl_metadata \\\nprovider=cPanel \\\nexcluded_domains='&#91;\"*.example.com\",\"example.com\"]'<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">6. Verify Auto-Renewal<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>crontab -l | grep acme<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This confirms that acme.sh will <a href=\"https:\/\/certera.com\/ssl-automation\/rapidssl-wildcard-automation\">renew your wildcard certificate automatically<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Method 3: Using Certbot + DNS Plugin<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For those using Apache or Nginx, Certbot is one of the easiest programs to use to obtain and renew a wildcard SSL certificate. It has been tested on Ubuntu 20.04+, CentOS 7+, AlmaLinux, Rocky Linux, and RHEL.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Install Certbot<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update -y\nsudo apt install certbot<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">2. Install the DNS Plugin, and you are done<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Set up the domain name server (DNS) plugin for your DNS provider.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Cloudflare:<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install python3-certbot-dns-cloudflare -y<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">DigitalOcean:<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install python3-certbot-dns-digitalocean<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Route 53:<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install python3-certbot-dns-route53<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">OVH:<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install python3-certbot-dns-ovh<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">3. Configure API Credentials<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Generate required credentials file and secure it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>chmod 600 ~\/.secrets\/certbot\/*.ini<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">4. Sign up for a Wildcard Certificate<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Cloudflare:<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo certbot --dns-cloudflare --dns-cloudflare-credentials ~\/.secrets\/certbot\/cloudflare.ini --dns-cloudflare-propagation-seconds 30 -d example.com -d \"*.example.com\"<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Route 53:<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo certbot certonly --dns-route53 -d example.com -d \"*.example.com\"<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">5. Set up your Web Server<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;re using Nginx or Apache, add the appropriate installer flag:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>--installer nginx<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>or<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>--installer apache<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">6. Test Auto-Renewal<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Check that the certificate is automatically renewed before its expiration date.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo certbot renew --dry-run<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Certbot will automatically generate a systemd timer or cron job to renew automatically in the future.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Method 4: Certbot + Azure DNS<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is the best way to do this when your domains are registered with Azure DNS, and you need to automate the creation of wildcard certificates.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Install Certbot and the Azure Plugin<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt install certbot\npip install certbot-dns-azure<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">2. Configure Azure Access<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Set up a Service Principal with the role of DNS Zone Contributor, and store the credentials under:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/letsencrypt\/azure\/credentials.ini<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Secure the file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>chmod 600 \/etc\/letsencrypt\/azure\/credentials.ini<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">3. The Wildcard Certificate is issued<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo certbot certonly \\\n--dns-azure \\\n--dns-azure-credentials \/etc\/letsencrypt\/azure\/credentials.ini \\\n-d example.com \\\n-d \"*.example.com\"<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Alternative: Manual DNS Challenge<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>If you don&#8217;t wish to use the Azure API, then run:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo certonly --manual --preferred-challenges=dns \\<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The domain name is considered to be a wildcard. The domain name is treated as a wildcard.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A TXT record will be displayed by Certbot. Add it to your Azure DNS Zone, wait for the DNS propagation, and press Enter to validate.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Common Troubleshooting<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If it is not possible to issue the certificate, consider the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Make sure that you have the right permissions in your DNS API token.<\/li>\n\n\n\n<li>Before validation, ensure that the TXT record has propagated.<\/li>\n\n\n\n<li>Ensure you install the appropriate DNS plugin for your ACME client.<\/li>\n\n\n\n<li>Avoid rate limits by using the staging environment of Let&#8217;s Encrypt.<\/li>\n\n\n\n<li>Keep in mind that example.com is not included in *.example.com. Always use both domains.<\/li>\n\n\n\n<li>\u00a0If you&#8217;re using cPanel, you need to filter out wildcard domains from AutoSSL to avoid conflicts.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most convenient ways to make managing certificates easier, while ensuring all your first-level subdomains are secured, is to use the ACME DNS challenge to issue a wildcard SSL certificate. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Regardless of your preferred option, the ultimate goal is to automate DNS validation renewals with your DNS provider&#8217;s API to minimise downtime and admin time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;re looking for a trusted SSL certificate provider, our team can help. Our <a href=\"https:\/\/certera.com\/automated-ssl-certificates\">Automated SSL certificates<\/a> are the best for your website or business and keep your domains secure and protected in shorter validity era.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Wildcard certificates make SSL a breeze to manage. You can add one cert for all the subdomains under example.com, rather than having to add one certificate per subdomain. The thing is,&nbsp;wildcard certificates must be validated with the DNS-01 challenge, and there is no HTTP-01 workaround. This requires you to create a DNS TXT record, and<span class=\"morelink d-block mt-3\"><a href=\"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/\">Read More<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":3346,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[54],"tags":[487,490,488,489,491],"class_list":["post-3342","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wildcard-ssl","tag-acme-dns-01-setup","tag-acme-wildcard-validation","tag-automated-wildcard-ssl","tag-dns-validation-for-acme-ssl","tag-install-acme-ssl-using-dns-method","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to Issue a Wildcard SSL with ACME DNS-01? [4 Methods]<\/title>\n<meta name=\"description\" content=\"Learn how ACME DNS-01 works and discover 4 practical ways to issue wildcard SSL certificates securely and automate certificate validation.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Issue a Wildcard SSL with ACME DNS-01? [4 Methods]\" \/>\n<meta property=\"og:description\" content=\"Learn how ACME DNS-01 works and discover 4 practical ways to issue wildcard SSL certificates securely and automate certificate validation.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/\" \/>\n<meta property=\"og:site_name\" content=\"Knowledge Base - Certera.com\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/certeraLLC\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-03T07:35:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-03T07:36:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/08\/acme-dns-challenge-setup.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"620\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"certerakbdbuser\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/08\/acme-dns-challenge-setup.webp\" \/>\n<meta name=\"twitter:creator\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:site\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"certerakbdbuser\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/\"},\"author\":{\"name\":\"certerakbdbuser\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#\\\/schema\\\/person\\\/c25e1519e333a817f30c805384cba014\"},\"headline\":\"How to Issue a Wildcard Certificate using ACME DNS Challenge &amp; API Token?\",\"datePublished\":\"2026-09-03T07:35:58+00:00\",\"dateModified\":\"2026-09-03T07:36:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/\"},\"wordCount\":847,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/acme-dns-challenge-setup.webp\",\"keywords\":[\"ACME DNS-01 setup\",\"ACME Wildcard Validation\",\"Automated wildcard ssl\",\"DNS Validation for ACME SSL\",\"Install ACME SSL using DNS method\"],\"articleSection\":[\"Wildcard SSL\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/\",\"name\":\"How to Issue a Wildcard SSL with ACME DNS-01? [4 Methods]\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/acme-dns-challenge-setup.webp\",\"datePublished\":\"2026-09-03T07:35:58+00:00\",\"dateModified\":\"2026-09-03T07:36:01+00:00\",\"description\":\"Learn how ACME DNS-01 works and discover 4 practical ways to issue wildcard SSL certificates securely and automate certificate validation.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/#primaryimage\",\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/acme-dns-challenge-setup.webp\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/acme-dns-challenge-setup.webp\",\"width\":960,\"height\":620,\"caption\":\"ACME DNS-01 Challenge for Wildcard\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/certera.com\\\/kb\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Issue a Wildcard Certificate using ACME DNS Challenge &amp; API Token?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#website\",\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/\",\"name\":\"Knowledge Base - Certera.com\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#organization\"},\"alternateName\":\"Certera Knowledgebase\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/certera.com\\\/kb\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#organization\",\"name\":\"Certera\",\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/brand-certera.svg\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/kb\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/brand-certera.svg\",\"caption\":\"Certera\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/certeraLLC\\\/\",\"https:\\\/\\\/x.com\\\/certera_llc\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/certera-llc\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/certera.com\\\/kb\\\/#\\\/schema\\\/person\\\/c25e1519e333a817f30c805384cba014\",\"name\":\"certerakbdbuser\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g\",\"caption\":\"certerakbdbuser\"},\"sameAs\":[\"https:\\\/\\\/certerakb.ssltoolsonline.com\"],\"url\":\"https:\\\/\\\/certera.com\\\/kb\\\/author\\\/certerakbdbuser\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Issue a Wildcard SSL with ACME DNS-01? [4 Methods]","description":"Learn how ACME DNS-01 works and discover 4 practical ways to issue wildcard SSL certificates securely and automate certificate validation.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/","og_locale":"en_US","og_type":"article","og_title":"How to Issue a Wildcard SSL with ACME DNS-01? [4 Methods]","og_description":"Learn how ACME DNS-01 works and discover 4 practical ways to issue wildcard SSL certificates securely and automate certificate validation.","og_url":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/","og_site_name":"Knowledge Base - Certera.com","article_publisher":"https:\/\/www.facebook.com\/certeraLLC\/","article_published_time":"2026-09-03T07:35:58+00:00","article_modified_time":"2026-09-03T07:36:01+00:00","og_image":[{"width":960,"height":620,"url":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/08\/acme-dns-challenge-setup.webp","type":"image\/jpeg"}],"author":"certerakbdbuser","twitter_card":"summary_large_image","twitter_image":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/08\/acme-dns-challenge-setup.webp","twitter_creator":"@certera_llc","twitter_site":"@certera_llc","twitter_misc":{"Written by":"certerakbdbuser","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/#article","isPartOf":{"@id":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/"},"author":{"name":"certerakbdbuser","@id":"https:\/\/certera.com\/kb\/#\/schema\/person\/c25e1519e333a817f30c805384cba014"},"headline":"How to Issue a Wildcard Certificate using ACME DNS Challenge &amp; API Token?","datePublished":"2026-09-03T07:35:58+00:00","dateModified":"2026-09-03T07:36:01+00:00","mainEntityOfPage":{"@id":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/"},"wordCount":847,"commentCount":0,"publisher":{"@id":"https:\/\/certera.com\/kb\/#organization"},"image":{"@id":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/08\/acme-dns-challenge-setup.webp","keywords":["ACME DNS-01 setup","ACME Wildcard Validation","Automated wildcard ssl","DNS Validation for ACME SSL","Install ACME SSL using DNS method"],"articleSection":["Wildcard SSL"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/","url":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/","name":"How to Issue a Wildcard SSL with ACME DNS-01? [4 Methods]","isPartOf":{"@id":"https:\/\/certera.com\/kb\/#website"},"primaryImageOfPage":{"@id":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/#primaryimage"},"image":{"@id":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/08\/acme-dns-challenge-setup.webp","datePublished":"2026-09-03T07:35:58+00:00","dateModified":"2026-09-03T07:36:01+00:00","description":"Learn how ACME DNS-01 works and discover 4 practical ways to issue wildcard SSL certificates securely and automate certificate validation.","breadcrumb":{"@id":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/#primaryimage","url":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/08\/acme-dns-challenge-setup.webp","contentUrl":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2026\/08\/acme-dns-challenge-setup.webp","width":960,"height":620,"caption":"ACME DNS-01 Challenge for Wildcard"},{"@type":"BreadcrumbList","@id":"https:\/\/certera.com\/kb\/how-to-issue-a-wildcard-certificate-using-acme-dns-challenge-api-token\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/certera.com\/kb\/"},{"@type":"ListItem","position":2,"name":"How to Issue a Wildcard Certificate using ACME DNS Challenge &amp; API Token?"}]},{"@type":"WebSite","@id":"https:\/\/certera.com\/kb\/#website","url":"https:\/\/certera.com\/kb\/","name":"Knowledge Base - Certera.com","description":"","publisher":{"@id":"https:\/\/certera.com\/kb\/#organization"},"alternateName":"Certera Knowledgebase","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/certera.com\/kb\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/certera.com\/kb\/#organization","name":"Certera","url":"https:\/\/certera.com\/kb\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/kb\/#\/schema\/logo\/image\/","url":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2023\/01\/brand-certera.svg","contentUrl":"https:\/\/certera.com\/kb\/wp-content\/uploads\/2023\/01\/brand-certera.svg","caption":"Certera"},"image":{"@id":"https:\/\/certera.com\/kb\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/certeraLLC\/","https:\/\/x.com\/certera_llc","https:\/\/www.linkedin.com\/company\/certera-llc\/"]},{"@type":"Person","@id":"https:\/\/certera.com\/kb\/#\/schema\/person\/c25e1519e333a817f30c805384cba014","name":"certerakbdbuser","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=mm&r=g","caption":"certerakbdbuser"},"sameAs":["https:\/\/certerakb.ssltoolsonline.com"],"url":"https:\/\/certera.com\/kb\/author\/certerakbdbuser\/"}]}},"_links":{"self":[{"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/posts\/3342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/comments?post=3342"}],"version-history":[{"count":6,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/posts\/3342\/revisions"}],"predecessor-version":[{"id":3357,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/posts\/3342\/revisions\/3357"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/media\/3346"}],"wp:attachment":[{"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/media?parent=3342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/categories?post=3342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/certera.com\/kb\/wp-json\/wp\/v2\/tags?post=3342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}