What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use ACME DNS-01 validation to obtain a wildcard certificate, then install the certificate and private key on your server and reload every service that uses them. DNS-01 is the only Let’s Encrypt validation method that can issue a wildcard, and it does not require Let’s Encrypt to reach your server on inbound port 80. For reliable renewals, give an ACME client narrowly scoped permission to create the required TXT record under _acme-challenge and configure a post-renewal reload hook.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a wildcard certificate covers
A wildcard certificate secures multiple hostnames that share one DNS label. A certificate for *.example.com covers names such as www.example.com, api.example.com and mail.example.com. It covers only one label: deep.api.example.com is not matched by *.example.com.
As an Amazon Associate I earn from qualifying purchases.
The wildcard does not cover the domain apex. example.com and *.example.com are different names, so request both when your site serves both. Certbot’s wildcard instructions document this distinction at certbot.eff.org.
One certificate can therefore simplify TLS management for several subdomains, but it also increases the impact of a stolen private key. Keep the key on the machines that need it, restrict its permissions, and revoke and replace the certificate if the key may have been exposed.
#1 Best Overall
Why wildcard issuance requires DNS-01
ACME clients prove control of a domain before a certificate authority issues a certificate. With DNS-01, the client derives a token and publishes it as a TXT record at _acme-challenge.example.com. The certificate authority queries DNS and issues the certificate after finding the expected value. Let’s Encrypt describes the process and the wildcard requirement in its challenge-type documentation.
HTTP-01 places a token at a web path and asks the authority to fetch it over HTTP. Let’s Encrypt explicitly states that HTTP-01 cannot issue wildcard certificates. DNS-01 is also useful when the server is private, behind a firewall, or intentionally has no public HTTP listener: the authority needs to query your DNS, not connect to port 80 on the server.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →DNS-01 has an operational consequence: every issuance and renewal needs a fresh TXT record. A provider with an API that your ACME client can call is preferable to a manual process, especially when certificates are renewed unattended.
Plan the names, DNS zone and services first
List the names you really serve
- Add
*.example.comfor one-level subdomains. - Add
example.comseparately if the apex is served. - Add another wildcard, such as
*.internal.example.com, only when that separate namespace is required; the first wildcard does not cover it. - Do not expect a wildcard to cover deeper names such as
node.eu.example.com.
Requesting only the names you use limits disclosure of unused hostnames and makes future certificate replacement easier. If a service is on a different base domain, request a certificate containing that name or use a separate certificate.
Confirm DNS control and delegation
You must be able to create TXT data in the authoritative DNS zone for the name being validated. Ask your DNS provider whether its API can create and remove TXT records, and whether an ACME client plugin exists. If the provider cannot automate updates, you can use a narrowly scoped authentication hook, but a person or script must complete each challenge and renewals will not be fully unattended.
Delegating only _acme-challenge.example.com to a separate validation zone can reduce the permissions held by the ACME client. The exact delegation procedure depends on the DNS provider, so verify that its API and record model support this arrangement before implementing it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check service dependencies
Identify every process that reads the certificate: a reverse proxy, web server, mail service, VPN endpoint, control panel or application gateway. Renewal is not complete when files have changed on disk; each dependent process must load the new files. Record the reload or restart command for every service and test it before the first renewal deadline.
Choose an ACME client and DNS automation method
Certbot and acme.sh are established ACME clients. Certbot’s documentation explains DNS plugins, certificate-only mode and renewal behavior in its Using Certbot guide. The acme.sh project documents certificate installation and reload hooks in its README.
| Approach | DNS API needed | Credential scope | Public port 80 needed | Renewal and reload |
|---|---|---|---|---|
| Certbot with a DNS plugin | Yes, through a supported provider plugin | Use a token limited to the required zone and record actions where the provider allows it | No for DNS-01 | certbot renew reuses the original options; configure a deploy hook to reload each service |
| Certbot with a manual DNS hook | Not necessarily; the hook can call your own automation | Controlled by your hook and its environment | No for DNS-01 | Not unattended unless both authentication and deployment hooks work without human input |
| acme.sh with DNS API integration | Usually yes | Store provider credentials with the least privilege available | No for DNS-01 | Use --reloadcmd or an equivalent install hook so renewed files are loaded |
Choose the method that can repeatedly update the authoritative zone and reliably reload every consumer. A technically successful first issuance is not enough if the same path cannot run unattended in the weeks that follow.
Prepare the server securely
- Make sure the server clock is correct. ACME requests and certificate validity checks depend on accurate time.
- Install the ACME client using your operating system’s package or the project’s documented installation method.
- Decide where the client will store account data, challenge credentials and issued files. Protect that directory from ordinary users and backups that are not encrypted.
- Back up current certificate and key files before changing paths, while keeping backup copies access-controlled.
- Verify that the account running the client can write the challenge record and read or deploy the resulting key and chain.
DNS API tokens are equivalent to control over part of your DNS. Prefer a token limited to the single zone used for validation. Do not put secrets directly in shell history, world-readable files or a web server document root. If your provider supports separate read and write permissions, grant only what the client needs to create and remove the TXT record.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRequest the wildcard with Certbot
Use certificate-only mode when you manage the server configuration yourself
Certbot’s certonly mode obtains and renews certificate files without editing your web-server configuration. This is a good fit when Nginx, Apache or another proxy has a hand-maintained configuration. An installer plugin can edit supported server configurations, but inspect every change before relying on it.
The DNS plugin name and credential options vary by provider. Use the provider’s Certbot plugin documentation rather than copying an option intended for another API. The command shape is:
sudo certbot certonly
--dns-PROVIDER
-d example.com
-d '*.example.com'Replace PROVIDER and its credential options with the plugin for your DNS service. The quoted wildcard prevents the shell from treating the asterisk as a filename pattern. If you need only subdomains, omit example.com; if you need the apex as well, include both names as shown.
Certbot creates the account, asks the DNS plugin to publish the challenge TXT value, waits for the authority to see it, and writes the certificate materials after validation. DNS propagation can take time. Do not delete a challenge record while validation is still pending.
Understand the files Certbot produces
Certbot normally maintains a lineage directory under /etc/letsencrypt/live/ with symlinks to the current certificate, private key and full chain. The exact path can differ if you selected another configuration directory. Use the paths printed by your client rather than assuming a custom location.
fullchain.pemcontains the server certificate followed by the issuing chain and is the file most web servers present to clients.privkey.pemis the private key. Restrict it to root and the service account that must read it.cert.pemcontains the leaf certificate without the additional chain.
Do not copy the private key into a repository or send it through chat or email. If several machines need the certificate, use a controlled deployment process and record where each copy exists.
Install the certificate on Nginx
Nginx expects a certificate chain and a matching private key. Its HTTPS configuration reference explains the ssl_certificate and key directives at nginx.org.
A minimal server block looks like this:
server {
listen 443 ssl;
server_name example.com *.example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
# location and application settings go here
}The server_name entries control routing; the certificate’s Subject Alternative Names control what clients accept. Include both apex and wildcard names in each place when both are served. Keep the key file unreadable by unrelated users, and ensure Nginx can traverse the parent directories.
After editing, test the complete configuration before reloading:
sudo nginx -t
sudo systemctl reload nginxIf the test reports a missing file, permission error or syntax problem, fix that error before reloading. A reload keeps existing connections while workers begin using the new configuration; a full restart is normally unnecessary for a certificate replacement.
Install on Apache or another TLS terminator
Apache and other proxies use different directive names and file layouts, but the requirements are the same: point the service at the new certificate chain and matching private key, test its configuration, then perform a graceful reload. Follow the service’s documented syntax and use the ACME client’s deployment hook to run those commands after a successful renewal.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →If TLS terminates at a load balancer or gateway rather than on the application host, install and reload the certificate there. Updating files on a backend server that never handles the TLS handshake will not change what clients see.
Automate renewal correctly
Certbot renewal
Certbot’s renew action examines installed certificates and renews those approaching expiry using the plugin and options saved for each lineage. The behavior is described in the Certbot documentation. Most package installations provide a systemd timer or cron job; verify which scheduler your installation uses and that it is enabled.
Renewal needs two independent hooks:
- An authentication hook that can create and remove the DNS-01 TXT record without interactive input.
- A deploy hook that runs only after a new certificate is successfully installed and reloads every dependent service.
A deploy hook can be a script stored outside the web root. It should test the service configuration, reload the service, log success or failure, and return a non-zero status when deployment fails. If multiple services consume the same certificate, reload all of them or deploy separate certificates so one failed consumer does not go unnoticed.
Run a dry test periodically:
sudo certbot renew --dry-runThe dry run checks the renewal path against the ACME test environment. It does not prove that every production service reloaded the new file, so also perform a real deployment test in a maintenance window and inspect the certificate presented by each hostname.
acme.sh installation and reload hooks
With acme.sh, issue the certificate through its DNS API mode, then install it into the paths your service reads. Configure --reloadcmd (or the project’s current install-cert hook syntax) so a renewal copies the updated files and reloads Nginx, Apache or the relevant proxy. The project calls this reload hook important in its documentation.
Do not point a service directly at a temporary issuance directory if the client may rotate files there. Use the client’s installation command or a controlled copy step, preserve ownership and permissions, and make the reload command idempotent so repeated renewals are safe.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify issuance, deployment and renewal
Check the DNS challenge
During issuance, query the authoritative DNS service for TXT data at _acme-challenge.example.com. You may see more than one TXT value when several validations are active; do not remove values belonging to another in-progress order. After the authority finishes validation, the client normally cleans up records it created.
Check the certificate actually served
Inspect each hostname from a client outside the server. Confirm that:
- The connection negotiates TLS without a name mismatch.
- The certificate includes the requested apex and wildcard names as appropriate.
- The presented chain is complete and trusted by normal clients.
- The expiration date advances after a renewal.
Checking only the files on disk can miss a stale worker process, a different proxy instance, an incorrectly selected virtual host or a load balancer that still holds the previous certificate.
Test the complete renewal path
- Run the client’s supported dry-run or staging renewal test.
- Confirm that the DNS token is created with no manual intervention.
- Confirm that the new files are copied to the production paths.
- Confirm that the configuration test succeeds.
- Confirm that every dependent service reloads.
- Connect to every covered hostname and record the newly served expiration date.
- Check logs and alerting so a future failed renewal produces a visible warning before expiry.
Troubleshoot common failures
“The wildcard was not issued”
- Verify that the request used DNS-01, not HTTP-01. HTTP-01 cannot issue wildcards.
- Check that the TXT record is exactly under
_acme-challengefor the requested domain. - Check for a typo in the zone, stale delegation or an API token that cannot write the authoritative zone.
- Wait for DNS propagation and query the authoritative nameservers rather than relying on one recursive resolver.
“The apex still shows a certificate error”
A certificate containing only *.example.com does not cover example.com. Request the apex as an additional name and configure the apex virtual host to use that certificate.
“Renewal succeeds but clients see the old certificate”
- Check whether the client wrote new files to a path different from the one configured in the server.
- Run the service’s configuration test manually.
- Inspect the deploy or reload hook’s exit status and logs.
- Reload the actual TLS terminator, including a load balancer or container sidecar if one sits in front of the web server.
- Verify every frontend address, IPv4 and IPv6 endpoint, because they may terminate TLS on different machines.
“The server cannot read the private key”
Check file ownership, mode bits and directory traversal permissions. Grant read access only to root and the service account that needs it. Avoid solving a permission error by making the key world-readable.
Security and operational practices
- Use a separate DNS API token for each server or deployment boundary when practical, so one compromise does not grant every host access to the zone.
- Limit tokens to the required zone and record operations; never embed a provider’s master account password in an automation script.
- Keep ACME account keys, DNS credentials and private keys out of source control and unencrypted general-purpose backups.
- Monitor certificate expiration and renewal failures. A timer that stops running can be as dangerous as a broken DNS hook.
- Document which hostnames are covered, where the private key is installed, which account runs renewal and which command reloads each consumer.
- Remove obsolete certificates and credentials when a service is decommissioned.
A wildcard reduces the number of certificates to distribute, but it creates a larger blast radius for the one private key. Use separate certificates instead when services have different administrators, trust boundaries or compromise risks.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Decision checklist
- Need a wildcard? Use it only for one-label subdomains that share an operational trust boundary.
- Need the apex too? Request
example.comand*.example.comtogether. - No public port 80? DNS-01 still works because validation occurs through DNS.
- Can your DNS provider automate TXT records? Prefer its ACME-compatible API or a supported client plugin.
- Can credentials be limited? Use the narrowest zone and record permissions available.
- Will renewal reload every consumer? Configure and test deploy or reload hooks, not just certificate issuance.
- Can you detect failure? Schedule dry runs, inspect logs and monitor the certificate presented by each hostname.
Following this sequence gives you a wildcard certificate that is not merely issued once, but remains deployed, renewed and verifiably active on the self-hosted services that depend on it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
