DE

Home / Acmefyer / Wildcard certificate

AcmefyerAgent-based Certificate Manager

Let’s Encrypt wildcard certificates, renewed automatically.

A certificate for *.example.com covers every name directly below your domain: www, mail, vpn, intranet. Let’s Encrypt issues it for free, but only through DNS validation. Acmefyer creates the validation record at your DNS provider itself, renews the certificate in time and installs it on every server that needs it.

Explore Acmefyer Documentation
01DNS-01Why a wildcard certificate only works via DNS

How DNS validation works.

For a wildcard certificate the certificate authority wants proof that you control the whole domain, not just one web server. That is why it requires a TXT record with a validation value under the name _acme-challenge:

_acme-challenge.example.com.  300  IN  TXT  "gfj9Xq...Rg85nM"

By hand that means for every renewal: get the validation value, create the record at the DNS provider, wait until it is visible, trigger validation, delete the record again. Acmefyer does this through your DNS provider’s API itself.

Coverage
*.example.com is valid for www.example.com or mail.example.com, but not for a.b.example.com and not for example.com itself. Acmefyer therefore adds example.com to the certificate.
More names
Acmefyer leaves out names the wildcard already covers, because the certificate authority would reject them otherwise.
DNS providers
Around 190, including Cloudflare, Hetzner, IONOS, INWX, netcup, all-inkl, AutoDNS, Azure DNS, Amazon Route 53 and Google Cloud DNS, plus your own DNS servers via RFC 2136.
Internal zone
If your own DNS server answers the zone differently from the internet, typically with Active Directory, Acmefyer asks public DNS servers such as Cloudflare or Quad9 to see the validation record.
Without port 80
With DNS-01 no server has to be reachable from the internet. This also works for internal servers with a public name.
02RolloutOne certificate, many servers

Issued once, installed everywhere.

The advantage of a wildcard certificate is that it fits many systems. That is exactly where it gets tedious: every renewal has to go to every web server, every mail system and every firewall. After every renewal Acmefyer distributes the new certificate to all targets, through agents on the target systems.

A note on security: the private key of a wildcard certificate then sits on every one of these systems. Where only a few names are needed, one certificate per service is the more cautious choice. Acmefyer can do both.

Windows
IIS, Exchange, HTTP.sys applications, MailStore Server, PRTG, ScriptRunner, Windows certificate store
Linux
NGINX, Apache, Traefik (also in a container), HAProxy, Tomcat, Gitea and any service that reads PEM files, such as Postfix or Proxmox
Firewall
FortiGate via REST API, through an agent in the DMZ
Files
PEM and PFX to a folder or a Windows share, via SSH to other servers, webhook
03SetupSet up once, then it runs on its own
  1. 01

    DNS access

    Store your DNS provider’s API token, once per account or project.

  2. 02

    Add a domain

    *.example.com with Let’s Encrypt and DNS-01. Acmefyer includes example.com itself.

  3. 03

    Choose targets

    The agents show where the certificate is needed. One click per target.

  4. 04

    Done

    From now on Acmefyer renews the wildcard certificate in time and installs it everywhere.

04FAQFrequently asked questions about wildcard certificates

Is a Let’s Encrypt wildcard certificate free?

Yes. Let’s Encrypt issues wildcard certificates for free, like any other certificate. Acmefyer is free for this too: without a license key it manages one domain with one subdomain or a wildcard certificate and one agent, with all features.

Why does a wildcard certificate not work with HTTP-01?

With HTTP-01 a single web server proves that it can be reached under a name. A wildcard certificate, however, is valid for all names under the domain. The certificate authorities therefore require proof through the domain’s DNS, that is DNS-01.

Does *.example.com also cover example.com?

No, the wildcard only covers names below it, and only one level deep. Acmefyer therefore adds example.com to the certificate by itself. Names such as a.b.example.com need their own certificate or *.b.example.com.

My DNS provider has no API. What now?

Acmefyer knows around 190 providers. If yours is missing, there are two common ways: delegate the _acme-challenge record via CNAME to a zone at a provider with an API, or use your own DNS server via RFC 2136.

How often is the wildcard certificate renewed?

Acmefyer renews every certificate 30 days before expiry and creates a new validation record each time. With the shorter lifetimes from 2027 and 2029 this works the same way, just more often.