letsencrypt wildcard certificates (without Cloudflare)

[rt87]

I would like to be able to use letsencrypt wildcard certificates without being limited to Cloudflare.

[Kipjr]

A temporary workaround is requesting a normal certificate ___domain.tld, then after a successful certificate, login to docker (docker exec -it {id} /bin/bash and do following:

certbot --manual -d ___domain.tld -d *.___domain.tld --preferred-challenges=DNS

Follow the instructions, it will replace your certificate with the wildcard. An automatic way is not yet possible due to the lacking support of numerous DNS APIs. This is what I'm doing every now and then..

You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/npm-2.conf)

It contains these names: ___domain.tld

You requested these names for the new certificate: ___domain.tld, *.___domain.tld.

Do you want to expand and replace this existing certificate with the new
certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: E
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for ___domain.tld

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Yes

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.___domain.tld with the following value:

Gasdfasdfasdfasdfasdfc

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Waiting for verification...
Cleaning up challenges

[hugalafutro]

I'm succesfully using wildcard host on noip.com with nginx-proxy-manager. I.e. on noip.com I have registered wildcard ___domain *.something.ddns.net, then in nginx-proxy-manager I have 11 proxy hosts using hostname.something.ddns.net and "it just works" (tm).

[rt87]

A temporary workaround is requesting a normal certificate ___domain.tld, then after a successful certificate, login to docker (docker exec -it {id} /bin/bash and do following:

certbot --manual -d ___domain.tld -d *.___domain.tld --preferred-challenges=DNS

Follow the instructions, it will replace your certificate with the wildcard. An automatic way is not yet possible due to the lacking support of numerous DNS APIs. This is what I'm doing every now and then..

You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/npm-2.conf)

It contains these names: ___domain.tld

You requested these names for the new certificate: ___domain.tld, *.___domain.tld.

Do you want to expand and replace this existing certificate with the new
certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: E
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for ___domain.tld

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Yes

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.___domain.tld with the following value:

Gasdfasdfasdfasdfasdfc

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Waiting for verification...
Cleaning up challenges

Thanks, good to know that this would work (and how to do it). But, to be clear: You would have to repeat this every now and then? The automatic renewal of this "manual wildcard certificate" would not work?

[rt87]

I'm succesfully using wildcard host on noip.com with nginx-proxy-manager. I.e. on noip.com I have registered wildcard ___domain *.something.ddns.net, then in nginx-proxy-manager I have 11 proxy hosts using hostname.something.ddns.net and "it just works" (tm).

Well... it really shouldn't! The UI doesn't even let you go for wildcards unless you checked the cloudflare option. Also, both providers, cloudflare and noip, charge for wildcards afaik, so thats something Im not too thrilled about either. And the free noip does not seem to support IPv6, which I would like to use since it "is time" and I do not have to give too much thought to portforwarding and such.

[Kipjr]

A temporary workaround is requesting a normal certificate ___domain.tld, then after a successful certificate, login to docker (docker exec -it {id} /bin/bash and do following:
certbot --manual -d ___domain.tld -d *.___domain.tld --preferred-challenges=DNS
Follow the instructions, it will replace your certificate with the wildcard. An automatic way is not yet possible due to the lacking support of numerous DNS APIs. This is what I'm doing every now and then..

You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/npm-2.conf)

It contains these names: ___domain.tld

You requested these names for the new certificate: ___domain.tld, *.___domain.tld.

Do you want to expand and replace this existing certificate with the new
certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: E
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for ___domain.tld

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.

Are you OK with your IP being logged?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Yes

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.___domain.tld with the following value:

Gasdfasdfasdfasdfasdfc

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Waiting for verification...
Cleaning up challenges

Thanks, good to know that this would work (and how to do it). But, to be clear: You would have to repeat this every now and then? The automatic renewal of this "manual wildcard certificate" would not work?

Yes, automatic renewal would require an API to your DNS and there are too many to support /implement this, I think.

I would like the output from the console on the webpage so I don't have to do this there. Then you only need to update your TXT record. Or just have a log page on the manager webpage.

[chaptergy]

@jc21 Implemented by PR #635, can be closed.
@rt87 To request wildcard certificates you need to request them via DNS challenge. If your DNS provider is not in the list of available DNS providers but you are sure they offer an API for this please open a new ticket.

[krouter]

Can you give a GUI option to request a manual DNS challenge?
Google domains doesn't allow DNS via api updates.

[chaptergy]

I don't think LetsEncrypt / Certbot is meant to issue certificates with a DNS challenge in a non-automated way. See the DNS challenge documentation, the second paragraph.

[jakern]

I think it would still be better to have a manual UI and the cert to accidentally expire than to not have SSL at all because you can't switch to a provider with an api

[chaptergy]

@jakern this is a little off topic for this issue, please see the following issue concerning the manual dns challenge: #813

[bryanhunwardsen]

I'm succesfully using wildcard host on noip.com with nginx-proxy-manager. I.e. on noip.com I have registered wildcard ___domain *.something.ddns.net, then in nginx-proxy-manager I have 11 proxy hosts using hostname.something.ddns.net and "it just works" (tm).

@hugalafutro
Were you able to use a wildcard cert for all the subdomains/proxy hosts?
I have what you indicate working, but each subdomain is requireing its own certificate as npm does not list no-ip as a dns challenge provider???

[hugalafutro]

@bryanhunwardsen yes. Each whatever.something.ddns.net site has its own cert which npm renews whenever needed. Honestly I am a bit of a newb so I don't even understand the dns challenge stuff or it's advantage as it works just fine without.