I have created and installed a cert for my wildcard domain *.example.com OK using a dns challenge. So far, so good.

Now I want to renew the cert using a cronjob. I will need to use the http challenge because my DNS host has no API mechanism for me to automatically create the TXT record. What I don't understand is how to tell certbot/letsencrypt where my http server is, given the domain is a wildcard that doesn't point to the server where I'm running certbot.

  • 1
    Even if your DNS host doesn't have an API, if you're up for it, you could do some reverse engineering of the (web, I'm guessing) interface you'd use to update DNS records, and then just write a certbot plugin to replicate the behavior of the interface.
    – Eric Reed
    Commented Oct 22, 2020 at 16:44

1 Answer 1


What you wanting is not possible. As per https://letsencrypt.org/docs/faq/#does-let-s-encrypt-issue-wildcard-certificates wildcard certs must be done via a DNS challenge.

This is also restated - along with DNS provider hints at https://letsencrypt.org/docs/challenge-types/

If you think about it this makes sense. To allow otherwise would enable issuing certs where the authority of the requestor is in doubt. (Ie someone who controls the TLD web site would be able to get a wildcard cert for subdomains which they may not be authorised to). On the flip side, someone who controlsndns for the domain automatically has the power to direct subdomains.

  • 4
    I'd recommend switching to a DNS host that has an API. Certbot has plugins for a dozen DNS hosts that make the process automatic: certbot.eff.org/docs/using.html?highlight=dns#dns-plugins It is usually possible to switch DNS hosting without changing website hosting. Commented Oct 22, 2020 at 11:00
  • thanks for the info. I was hoping that certbot could use the fact that it can see the existing cert and private key files as sufficient authorisation to do a renew.
    – pinoyyid
    Commented Oct 22, 2020 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.