My domain is: tentacom.net I ran this command: sudo certbot certonly --manual -d “*.tentacom.net” --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory Using certbot 0.23.0.dev0 (from git, commit b6afba0d64…

[image] arjen: “ tentacom.net uses an invalid security certificate. The certificate is only valid for *.tentacom.net Yes, that's correct. *.tentacom.net does not include tentacom.net .

[image] arjen: -d “*.tentacom.net” You need to request the wildcard AND root on the same cert, and validate challenges for both. certbot certonly --manual -d “*.tentacom.net” -d tentacom.net --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory beware that s…

Thanks for your very quick reply! [image] danb35: Yes, that’s correct. *.tentacom.net does not include tentacom.net . Righty. I'll take your point in the context of Let's Encrypt certificates, however I do note that I have other wildcard certificates that appear to do exactly that? So how …

[image] arjen: I’ll take your point in the context of Let’s Encrypt certificates, however I do note that I have other wildcard certificates that appear to do exactly that? It's how certificates work, not a specific limitation of Let's Encrypt. Your other certificates evidently include both ex…

Awesome, thanks for the clarification. From observation, most blog articles posted on “how to get a wildcard certificate with Let’s Encrypt” are thus incomplete and incorrect…

I can confirm that the extended process as described in this thread indeed works. Thanks all!

Hmm one more pondering, what happens around renewal - do the TXT fields remain valid for a renewal, or do they need to be updated? Do I need to adjust settings in the letsencrypt configs after the initial certificate is retrieved, because the process used --manual. Will the renewal process be happy…

Hi @arjen , [image] arjen: Hmm one more pondering, what happens around renewal - do the TXT fields remain valid for a renewal, or do they need to be updated? The current TXT records won't be valid, you will need to update them. [image] arjen: Do I need to adjust settings in the letsencry…

Hi @sahsanu , k clear, thanks. Only (some of) the DNS slaves are Linode, we run our own primary. I was looking at RFC 2136 (lexicon-dns doesn’t support that generic approach yet, it focuses on hosting providers) but haven’t worked through the details of that yet. Regards, Arjen.

Certbot wildcard certificate invalid for base domain

Help

danb35 April 7, 2018, 12:35am 2

Yes, that's correct. *.tentacom.net does not include tentacom.net.

Issues deploying wildcard certificate with certbot

Topic		Replies	Views
Making a certificate for a base domain plus its wildcard "in one" creates two TXT records, overwriting the first one, breaking the challenge ("During secondary validation: Incorrect TXT record") Help	3	175	October 29, 2025
Wildcard and domain registration breaks registration? Help	8	602	May 1, 2023
Confusing on root domain with wildcard cert Issuance Policy	4	18144	March 15, 2018
One certificate for both base domain and its wildcard Help	3	2439	March 14, 2018
Problem with wildcard certificate Help	7	1116	April 19, 2024

Certbot wildcard certificate invalid for base domain

Related topics