# Letsencrypt on subdomain **URL:** \ **Category:** Help\ **Created:** [August 11, 2018, 11:05am UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113 "2018-08-11T11:05:05Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![conquistadorjd](https://avatars.discourse-cdn.com/v4/letter/c/b9e5f3/32.png) [@conquistadorjd](https://community.letsencrypt.org/u/conquistadorjd)\ **Post date:** [August 11, 2018, 11:05am UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/1 "2018-08-11T11:05:05Z")
I wanted to make subdomains secued by using letsencrypt. however, when while accessing subdomain, I am getting following error “This server could not prove that it is [conquistadorjd.goingplaces.me](http://conquistadorjd.goingplaces.me); its security certificate is from [goingplaces.me](http://goingplaces.me). This may be caused by a misconfiguration or an attacker intercepting your connection.” My domain is: [goingplaces.me](http://goingplaces.me) My web server is (include version): nginx The operating system my web server runs on is (include version): ubuntu 16.04 and chrome My hosting provider, if applicable, is: digital ocean I can login to a root shell on my machine (yes or no, or I don’t know): yes If i register “[conquistadorjd.goingplaces.me](http://conquistadorjd.goingplaces.me)” I get similar error for [goingplaces.me](http://goingplaces.me). Can you please let me know how to make sub domains also secured ? ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [August 11, 2018, 11:06am UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/2 "2018-08-11T11:06:33Z")
Put both the subdomain and the domain on the certificate. Since you didn’t answer the questions you were presented when you started this topic, I can’t really tell you how to do that with your client. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [August 11, 2018, 11:11am UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/3 "2018-08-11T11:11:05Z")
> [@danb35](#): > > Since you didn’t answer the questions you were presented when you started this topic Unfortunately, if one types things in the text box first and _then_ set the section to "Help", there won't be any questions presented.. @conquistadorjd Here are the questions @danb35 meant, could you fill them in as complete as you can? Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: I ran this command: It produced this output: My web server is (include version): The operating system my web server runs on is (include version): My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): I'm using a control panel to manage my site (no, or provide the name and version of the control panel): ---
**Author:** ![conquistadorjd](https://avatars.discourse-cdn.com/v4/letter/c/b9e5f3/32.png) [@conquistadorjd](https://community.letsencrypt.org/u/conquistadorjd)\ **Post date:** [August 11, 2018, 11:43am UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/4 "2018-08-11T11:43:31Z")
@Osiris @danb35 Thanks for your response. I ran following command and now error is not showing up, however subdomain is not being shown as secured `sudo certbot --nginx -d goingplaces.me -d www.goingplaces.me -d conquistadorjd.goingplaces.me -d www.conquistadorjd.goingplaces.me` ![2018-08-11%2017-11-26%20lets%20encrypt](https://global.discourse-cdn.com/letsencrypt/original/3X/6/1/61a3f02aa385521ae2173440905ac6cc1cffba9e.png) I am planning to use this site as multisite, there will be large number of subdomains. I tried to search for subdomain wildcard but could not find much, can you please assist me? I did use part of the questionnaire, I skipped following questions as these were not relevant I ran this command: It produced this output: ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [August 11, 2018, 11:46am UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/5 "2018-08-11T11:46:06Z")
[https://www.whynopadlock.com/results/111369f2-d446-4780-bc8e-5206f6c37d15](https://www.whynopadlock.com/results/111369f2-d446-4780-bc8e-5206f6c37d15) ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [August 11, 2018, 12:44pm UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/6 "2018-08-11T12:44:44Z")
> [@conquistadorjd](#): > > I tried to search for subdomain wildcard but could not find much Wildcard-certificates are possible. You have to use dns-01 - challenge, so you should have a dns-provider with an api. Then you need only one certificate with two names - \*.goingplaces.me and [goingplaces.me](http://goingplaces.me) But you can't create something like _._.goingplaces.me, so [www.conquistadorjd.goingplaces.me](http://www.conquistadorjd.goingplaces.me) isn't supported. And fix your mixed content warnings - http -\> https. Chrome / FireFox, Ctrl + Shift + I, then select the console. http :// conquistadorjd . files . wordpress . com / 2013 / 05/img\_6200-1.jpg ---
**Author:** ![conquistadorjd](https://avatars.discourse-cdn.com/v4/letter/c/b9e5f3/32.png) [@conquistadorjd](https://community.letsencrypt.org/u/conquistadorjd)\ **Post date:** [August 17, 2018, 9:14am UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/7 "2018-08-17T09:14:07Z")
Thanks for your response, is there any step by step guide for wildcard subdmaon registration ? like the one for this one for letsencrypt for simple domain ? [https://www.techtrekking.net/how-to-add-ssl-and-https-to-wordpress/](https://www.techtrekking.net/how-to-add-ssl-and-https-to-wordpress/) and yes, I am fine with \*.goingplaces.me , _._.goingplaces.me is not required ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [August 17, 2018, 9:53am UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/8 "2018-08-17T09:53:56Z")
> [@conquistadorjd](#): > > is there any step by step guide for wildcard subdmaon registration That isn't required. You have already certificates created. With Certbot? If yes. 1. Check your Certbot version. Wildcard-certificates need the ACME-protocol v2. 2. First use the v2 - staging/testsystem. [https://certbot.eff.org/docs/using.html#certbot-commands](https://certbot.eff.org/docs/using.html#certbot-commands) If I know it correct, it's enough to define -d \*.goingplaces.me as domain name. If there is no other info, Certbot may ask. Certbot certonly --manual --test-cert -d \*.goingplaces.me ---
**Author:** ![conquistadorjd](https://avatars.discourse-cdn.com/v4/letter/c/b9e5f3/32.png) [@conquistadorjd](https://community.letsencrypt.org/u/conquistadorjd)\ **Post date:** [August 19, 2018, 12:58pm UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/9 "2018-08-19T12:58:08Z")
Thanks @JuergenAuer I followed theinstruction. Added text record but got following error ``` Before continuing, verify the record is deployed. ------------------------------------------------------------------------------- Press Enter to Continue Waiting for verification... Cleaning up challenges Failed authorization procedure. goingplaces.me (dns-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: No TXT record found at _acme-challenge.goingplaces.me IMPORTANT NOTES: - The following errors were reported by the server: Domain: goingplaces.me Type: unauthorized Detail: No TXT record found at _acme-challenge.goingplaces.me To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address ``` Not sure if there is delay from domain provider in applying TXT record. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [August 19, 2018, 1:25pm UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/10 "2018-08-19T13:25:49Z")
> [@conquistadorjd](#): > > Detail: No TXT record found at \_acme-challenge.goingplaces.me I can't find a txt record > \_acme-challenge.goingplaces.me > \_acme-challenge.goingplaces.me.goingplaces.me (sometimes seen) And there is no CNAME record with one of these names. Tested local and online. Can you create a picture of the menu you had used? ---
**Author:** ![conquistadorjd](https://avatars.discourse-cdn.com/v4/letter/c/b9e5f3/32.png) [@conquistadorjd](https://community.letsencrypt.org/u/conquistadorjd)\ **Post date:** [August 19, 2018, 1:43pm UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/11 "2018-08-19T13:43:09Z")
> [@JuergenAuer](#): > > And there is no CNAME record with one of these names. Tested local and online. I guess, this is the main issue but when I added CNAME record in 1. digitalocean and 2.bigrock (domain name reseller) I got following error at txt record ![2018-08-19%2019-12-40%20letssencrypt%20error](https://global.discourse-cdn.com/letsencrypt/original/3X/6/5/659fe537633e30c8f6207a68948f1569c11fb6a5.png) ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [August 19, 2018, 1:46pm UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/12 "2018-08-19T13:46:46Z")
> [@JuergenAuer](#): > > And there is no CNAME record with one of these names. I meant: You don't need a CNAME, but I checked if you had created \_acme-challenge.goingplaces.me as CNAME with the value. You don't need a CNAME, you need only \_acme-challenge.goingplaces.me as TXT entry. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [August 19, 2018, 1:51pm UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/13 "2018-08-19T13:51:03Z")
You have a long TTL - I use a TTL with 300 seconds (not digitalocean). But your entries are ok. Remove the CNAME record with this name. PS: You have another CNAME which is wrong: > \_acme-challenge.goingplaces.me canonical name = [goingplaces.me](http://goingplaces.me) ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [September 18, 2018, 1:51pm UTC](https://community.letsencrypt.org/t/letsencrypt-on-subdomain/69113/14 "2018-09-18T13:51:03Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.