> ## Content Index
> Fetch the complete content index at: https://blog.alphavps.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to Install Let’s Encrypt Wildcard SSL on Your Linux VPS
- URL: https://blog.alphavps.com/how-to-install-lets-encrypt-wildcard-ssl-on-your-linux-vps/
- Published: 2026-03-26T11:55:36.000Z
- Updated: 2026-09-08T15:18:05.000Z
- Author: Karim Buzdar
- Tags: Tutorials, Security, Web Servers

Securing your Linux VPS with HTTPS is essential, especially if you're running multiple applications or subdomains on the same server. You can secure all subdomains under your domain with a Let's Encrypt Wildcard SSL Certificate instead of installing multiple individual SSL certificates. Wildcard SSL is required to verify DNS-01, which means you need to add a TXT DNS entry to your domain.

This guide will walk you through the steps of installing a Let's Encrypt Wildcard SSL Certificate using Certbot with DNS verification. Each command and configuration line is explained.

## What is a Let’s Encrypt Wildcard SSL?

Wildcard SSL protects all your subdomains and domains.

```text
*.example.com
```

One certificate is sufficient to protect:

- blog.example.com
- shop.example.com
- api.example.com
- ANY future subdomain

## How to Install Let’s Encrypt Wildcard SSL on Your Linux VPS 

Installing a free Let's Encrypt Wildcard SSL Certificate on your Linux Virtual Private Server is the best way to secure your entire subdomains. Certbot's DNS-01 verification ensures compatibility with all web servers, whether you are using Nginx, Apache, Caddy, or a custom-built application. Renewals are made easy with automated DNS plugins. Wildcard SSL is ideal for multi-app environments.

### Step 1: Install Certbot (SSL Client) and DNS Plugin

Certbot, the official tool for requesting Let's Encrypt certificates, is available. Install the latest version by using this list of updates.

```bash
sudo apt install certbot python3-certbot-dns-cloudflare -y
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-2ecead2d-5062-434e-acc3-e5540a9383ea.png)

**Explanation:**

- Certbot is the main tool for generating SSL certificates
- python3-certbot-dns-cloudflare - DNS plugin for automatic TXT record creation
- Replace Cloudflare DNS plugin with your own if necessary.

### Step 2: Request the Wildcard SSL Certificate

Use Certbot for DNS validation:

```bash
sudo certbot certonly --manual --preferred-challenges=dns -d "*.example.com" -d "example.com"
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-c39bb8b0-e7ab-4d80-9fca-ce8116372716.png)

Explanation of each option:

- **certonly**You can generate a certificate without changing your web server.
- **\--manual**Tell Certbot that you will manually update DNS records (TXT).
- **\--preferred-challenges=dns**Force DNS-based Verification (required when using wildcard SSL).
- **\-d "\*.example.com"**Requests wildcard cover for all subdomains.
- **\-d "example.com"**Adds the root domain to the same certificate.

Certbot will now instruct you to create DNS TXT records.

### Step 3: Add the TXT DNS Record

Certbot displays a record that looks like this. If not, create a record in TXT under the following name:

```text
_acme-challenge.example.com
```

Let's Encrypt verifies this TXT to ensure you own the domain. Verify DNS propagation (optional but recommended):

```bash
dig TXT _acme-challenge.example.com
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-aa971aef-df5b-4296-bb51-39ebb249e12a.png)

If the value appears, DNS is ready.

### Step 4: Complete the Verification

Press ENTER on the terminal. If DNS is correct, Certbot will output something like this:

```bash
cat /etc/letsencrypt/ssl-dhparams.pem
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-ad11b069-fe29-4fbc-beb4-a864d5cac81b.png)

Congratulations! Your wildcard certificate has been saved.

### Step 5: Install Wildcard SSL on Nginx or Apache

Open your site config:

```bash
sudo nano /etc/nginx/sites-available/example.com.conf
```

Add or edit:

```nginx
server {
    listen 443 ssl;
    server_name *.example.com example.com;
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-380d221f-2313-4652-9ea8-f607f4994574.png)

**Explanation:**Loads the private key required for SSL. Test Nginx:

```bash
sudo nginx -t
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-8e8cc631-0211-43d2-ab48-ee4b225cc1bb.png)

Reload:

```bash
sudo systemctl reload nginx
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-2a8f56fc-d24b-4352-9eb3-17793e4a64c5.png)

### Step 6: Enable Automatic Renewal

Let’s Encrypt certificates expire every **90 days**. Test auto-renew:

```bash
sudo certbot renew --dry-run
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-5c11389d-3dfa-4975-bc16-d0f8d87cf7d3.png)

**Manual DNS Users**

You must repeat DNS TXT verification every renewal. DNS Plugin Users (Cloudflare, DigitalOcean, Google). Renewal happens automatically, no TXT interaction needed.

### Using Cloudflare for Full Automation (Recommended)

Create API credentials:

```bash
sudo nano /root/cloudflare.ini
```

Add:

```bash
dns_cloudflare_api_token = YOUR_API_TOKEN
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-cba4e6e0-18de-4e4b-aeeb-8800169ead44.png)

Fix permissions:

```bash
sudo chmod 600 /root/cloudflare.ini
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-cedccab5-01dc-4811-840a-e4f5c7c39f52.png)

Generate wildcard SSL automatically:

```bash
sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials /root/cloudflare.ini -d "*.example.com" -d "example.com"
```

![](https://blog.alphavps.com/content/images/2025/11/data-src-image-0dd6148f-29e0-4d2a-9dbf-1bddb08e52e8.png)

Certbot uses the Cloudflare API to create the TXT record automatically.

## Conclusion

To install a Let's Encrypt Wildcard SSL on your Linux VPS, you first need to install Certbot along with the appropriate DNS plugin, then request the certificate using DNS-01 verification by running certbot certonly --manual --preferred-challenges=dns -d "\*.example.com" -d "example.com", after which Certbot will provide a TXT record that you must add to your DNS under \_acme-challenge.example.com; once DNS propagation is complete, Certbot issues the wildcard SSL and stores it in /etc/letsencrypt/live/yourdomain/, allowing you to configure your web server (Nginx or Apache) by pointing to fullchain.pem and privkey.pem, and finally enabling automatic renewal through either DNS plugins or manual TXT updates depending on your setup.

Secure your [**Cheap VPS**](https://alphavps.com/cheap-vps.html?ref=blog.alphavps.com) with Let’s Encrypt Wildcard SSL by reading this step-by-step guide.