Recommended Free Tools
You can issue a free Let’s Encrypt wildcard certificate on a VPS, but only with the DNS-01 challenge. Certbot creates a temporary TXT record at _acme-challenge.example.com to prove control of the domain; HTTP-01 cannot issue wildcard certificates. For a certificate that works for both the apex domain and its first-level subdomains, request example.com and *.example.com together, then install the certificate and private key in your web server or reverse proxy.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What a wildcard certificate covers
A wildcard name matches one label immediately to the left of the domain. The name *.example.com covers www.example.com, api.example.com and mail.example.com. It does not cover the apex example.com, and it does not cover deeper names such as dev.api.example.com. Include both names in the certificate request when visitors must reach the bare domain and subdomains.
As an Amazon Associate I earn from qualifying purchases.
| Requested name | Covered | Not covered |
|---|---|---|
example.com |
The apex domain | Subdomains unless separately listed |
*.example.com |
One-label hosts such as www.example.com |
example.com and deeper names such as a.b.example.com |
| Both names | The apex and one-label subdomains | Names below a second subdomain level |
Prerequisites on the VPS and domain
- SSH access with permission to install packages and reload the web server.
- A registered domain whose authoritative DNS zone you can edit.
- Knowledge of which company hosts the authoritative nameservers. Editing a DNS record at a non-authoritative provider will not satisfy the challenge.
- A web server or reverse proxy that can use a PEM-encoded certificate and private key.
- A plan for renewal. Let’s Encrypt certificates currently have 90-day validity, so renewal must be routine rather than an annual task.
VPS users normally manage their Certbot installation themselves. The package command differs between distributions and repositories, so identify the operating system before copying an installation command. Use the Certbot instructions for that distribution, then install the DNS plugin for your authoritative provider; DNS plugins are not included in every default Certbot installation.
Why wildcard issuance uses DNS-01
During DNS-01 validation, the ACME client asks you to publish a value in a TXT record at _acme-challenge.<your-domain>. Let’s Encrypt queries public DNS and issues the certificate only after it finds the expected value. DNS-01 is the challenge that supports wildcard names. HTTP-01 validates a file over HTTP and cannot be used to issue a wildcard certificate.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Because validation happens in DNS, the CA does not need to connect to your VPS. Port 80 does not have to be open, and an existing HTTP site is not required for this method. The same certificate can serve several web servers, private services, or load-balanced nodes as long as each system receives the resulting certificate and key securely.
Choose a DNS validation method
| Method | Renewal automation | DNS API and credentials | Propagation behavior | Operational complexity |
|---|---|---|---|---|
| Provider plugin | Automatic when the plugin can create and remove TXT records | Requires an API token or key; scope it to the needed zone and record operations | The plugin waits or retries according to its behavior; slow DNS may still require extra propagation time | Lowest for recurring certificates |
| Manual DNS | Not automatic unless authentication and cleanup hook scripts are supplied | No API is required, but an operator must change DNS for every issuance or renewal | You must wait for the TXT record to become visible publicly | Simple for a one-off certificate, burdensome for renewals |
| Delegated validation | Can be automated by delegating the challenge name to a zone you control by API | Credentials are kept with the delegated DNS service rather than the main zone | Delegation and TXT propagation must both work correctly | Useful for central certificate operations, but requires careful DNS design |
Let’s Encrypt recommends DNS-01 automation when your DNS provider has an API. Certbot has provider plugins for services including Cloudflare, DigitalOcean, DNSimple, Google, Linode, OVH and Route 53, among others. Select the plugin documented for your provider rather than assuming that similarly named packages are interchangeable.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Install Certbot and the provider plugin
- Connect to the VPS over SSH and identify its operating system and package manager.
- Install Certbot using the current method recommended for that operating system. Distribution packages, Python environments and containerized installations can have different plugin paths.
- Install the DNS plugin matching the authoritative provider. The package is usually separate from the core Certbot package.
- Create a credentials file or secret recognized by that plugin. Follow the plugin’s documented format and permissions exactly; do not paste a token into a shell history or commit it to a repository.
- Run the plugin’s help command or Certbot’s plugin listing to confirm that it is installed and recognized before requesting a certificate.
Do not treat the representative command below as universal. Replace <provider> with the documented plugin name and add the provider-specific credential and propagation options required by that plugin.
sudo certbot certonly --dns-<provider> -d example.com -d '*.example.com'certonly obtains the certificate but does not edit your web-server configuration. That separation is useful when a reverse proxy, container, unusual configuration, or multiple services controls TLS termination.
Issue the wildcard certificate with an API plugin
1. Prepare narrowly scoped credentials
Create an API token that can change DNS records only in the required zone. Prefer a token limited to TXT record management or the smallest permissions offered by the provider. Store it in the provider’s expected credentials file, restrict that file to the account that runs Certbot, and ensure backups do not expose it.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
2. Request the apex and wildcard names
Use separate -d arguments for the apex and wildcard names:
sudo certbot certonly --dns-<provider> -d example.com -d '*.example.com'The plugin creates the TXT record under _acme-challenge.example.com. Some providers require an explicit zone identifier, credentials-file option or propagation-seconds setting. Use the exact options in that plugin’s documentation.
3. Wait for DNS propagation
DNS changes are not always visible immediately from every resolver. Certbot may pause while it waits, but authoritative nameservers, recursive resolvers and provider propagation systems can take different amounts of time. If validation fails, query the authoritative nameservers for the TXT value and wait until the expected value is publicly visible before retrying.
4. Confirm the resulting files
After successful issuance, Certbot reports the certificate name and locations. A conventional installation keeps versioned files under /etc/letsencrypt and exposes the active certificate and key through a live directory. Use the paths printed by your run rather than assuming the certificate name, especially if you have issued more than one certificate for the same domain.
Use manual DNS when no plugin is available
Manual mode is suitable for an occasional certificate or a DNS provider without an API. Certbot prints the TXT record name and value; create that record at your authoritative DNS provider, wait for propagation, and press Enter so validation can continue.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
- Start a manual DNS request for the apex and wildcard names.
- Copy the TXT record name and value exactly as Certbot displays them. Your DNS control panel may automatically append the zone name, so check the resulting fully qualified name.
- Publish the record and verify it from outside the VPS using a DNS lookup tool or several public resolvers.
- Continue Certbot’s prompt only after the value is visible.
- Remove obsolete challenge records when Certbot instructs you to do so, while retaining any record still required by another active validation.
Certificates created with --manual do not renew automatically by themselves. Certbot documents that automatic renewal requires an authentication hook that creates the TXT record and, when appropriate, a cleanup hook that removes it. Without those hooks, every renewal requires an operator to repeat the DNS procedure.
Install the certificate in your web server
With certonly, deployment is your responsibility. Configure the service that terminates TLS with the certificate chain and private key paths reported by Certbot, then reload the service so it reads the new files. Keep the private key readable only by the account or group that needs it.
Nginx, Apache and reverse proxies
Certbot has Nginx and Apache installers that can update supported configurations automatically. Those installers are convenient when your virtual-host configuration is conventional. If you use a custom reverse proxy, a container ingress, a mail service or several front ends, copy the certificate and key through your existing deployment process and reload each TLS terminator.
Do not replace a running certificate by editing files in place without a reload. A successful ACME issuance does not prove that the public service is presenting the new certificate; check the service after reloading and verify both the apex and a representative subdomain.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Automate renewal before the 90-day deadline
Let’s Encrypt’s integration guidance says that for current 90-day certificates, renewal should occur 30 days before expiration. Enable the Certbot timer or scheduled job installed by your operating system, and ensure the renewal command can access the DNS plugin credentials without interactive input.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Run Certbot’s renewal simulation or dry-run facility with the same DNS plugin and credential configuration used in production.
- Confirm that the simulated process can create, observe and clean up a TXT record.
- Configure a deploy hook to reload the web server only after a certificate has actually renewed. This avoids unnecessary reloads and ensures services pick up the new files.
- Monitor the scheduled job and certificate expiration. A timer that runs is not enough if the DNS API token has expired or propagation repeatedly times out.
- Repeat the test after changing providers, credentials, DNS delegation or the TLS-terminating service.
Use a staging endpoint when developing scripts that may issue repeatedly; staging certificates are for testing and are not trusted by normal browsers. A dry run tests the renewal path without replacing the production certificate. Neither test guarantees success on a different VPS or with a later provider API change, so inspect the output on your own system.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect DNS credentials and private keys
DNS API access can change the entire zone, redirect traffic or defeat other validation controls. Let’s Encrypt warns that putting full DNS credentials on a web server increases the impact of a server compromise. Use the narrowest token available, isolate certificate automation from application processes, restrict file permissions, rotate credentials, and revoke a token immediately if the VPS is breached.
- Keep credentials outside web roots, source-control repositories and container images.
- Use a dedicated system account for Certbot where practical.
- Limit API permissions to the required zone and record actions.
- Back up certificates only in encrypted storage; treat private keys as secrets.
- When several servers need the certificate, distribute the key over an authenticated channel and delete temporary copies.
Troubleshoot common failures
The TXT record cannot be found
Check that the record is at _acme-challenge.example.com, not at the server hostname or a web subdomain. Confirm that the provider did not duplicate the zone suffix, and query the authoritative nameservers rather than relying only on a local resolver cache. Wait longer if the provider reports pending propagation.
Validation succeeds for one name but not the other
Each requested identifier must be authorized. Recheck that both example.com and *.example.com were included and that the plugin created the required challenge data. A wildcard does not authorize the apex automatically.
Certbot cannot load the plugin
Install the provider plugin separately, verify that it matches the Certbot installation environment, and list available plugins. Mixing a distribution package with a separately installed Python package can place the plugin where the active Certbot process cannot see it.
Renewal asks for keyboard input
This usually indicates manual mode or missing hook configuration. Replace manual validation with an API plugin when possible, or implement and test authentication and cleanup hooks that create and remove the TXT record non-interactively.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe certificate renewed but the site still shows the old one
Check which process terminates TLS, confirm its configuration points to Certbot’s current live paths, and run the required reload or restart. In a load-balanced setup, inspect every node; DNS-01 validates the domain but does not distribute certificate files to your servers.
Using one wildcard certificate on multiple servers
DNS-01 does not depend on a particular web server, so a certificate can be used by several VPS instances, internal services or hosts that are not publicly reachable. The trade-off is key distribution: every TLS terminator holding the private key becomes part of the certificate’s security boundary. Centralize issuance where possible, then deliver renewed files through an authenticated deployment system and reload each service with a deploy hook.
If separate teams must request certificates, delegating _acme-challenge to a controlled DNS zone can keep broad production DNS credentials off individual servers. Validate the delegation before relying on it, and document who owns the delegated zone and its renewal automation.
Final checklist
- Authoritative DNS is identified and editable.
- The DNS-01 provider plugin is installed and recognized.
- API credentials are narrowly scoped and protected.
- The request includes
example.comand*.example.comwhen both are needed. - TXT propagation is verified before validation.
- The certificate and private key are installed on every TLS terminator.
- A reload or deploy hook activates renewed files.
- A staging or dry-run renewal test completes with the same plugin configuration.
- Monitoring warns well before the 90-day expiration window.
Bottom line
The reliable free path is Certbot plus your DNS provider’s API plugin using DNS-01. Request the apex and wildcard names explicitly, wait for TXT propagation, install the resulting files, and test an automated renewal process that runs about 30 days before expiration. Manual DNS works for one-off issuance, but without hooks it leaves renewal dependent on a person and is not a durable production setup.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
