# There is no root domain in the wildcard certificate **URL:** \ **Category:** Help\ **Created:** [August 19, 2021, 4:51am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114 "2021-08-19T04:51:33Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![250king](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/250king/32/48809_2.png) [@250king](https://community.letsencrypt.org/u/250king)\ **Post date:** [August 19, 2021, 4:51am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/1 "2021-08-19T04:51:33Z")
My website: [www.shirosaki-hana.fun](https://www.shirosaki-hana.fun/) I have apply a wildcard certificate. But I find there is no root domainin the certificate. So if I visit the [shirosaki-hana.fun](https://shirosaki-hana.fun/) ... ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/f/d/fdf9002b6b1974af65a05d07883e98458720ca25.png) ---
**Author:** ![250king](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/250king/32/48809_2.png) [@250king](https://community.letsencrypt.org/u/250king)\ **Post date:** [August 19, 2021, 4:52am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/2 "2021-08-19T04:52:12Z")
![image](https://global.discourse-cdn.com/letsencrypt/original/3X/3/0/305aef9f999e5c72c59244df2964c30cb53d2480.png) ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [August 19, 2021, 5:37am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/3 "2021-08-19T05:37:29Z")
Yes, your wildcard certificate only covers subdomains. You need to also include `shirosaki-hana.fun` as a Subject Alternative Name (SAN). With certbot I believe this is done using `certbot --expand -d *.shirosaki-hana.fun,shirosaki-hana.fun`. Note that you will need to perform TXT validation for both identifiers which will mean your TXT record either has to hold two values or you need to validate one then move onto the other. ---
**Author:** ![250king](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/250king/32/48809_2.png) [@250king](https://community.letsencrypt.org/u/250king)\ **Post date:** [August 19, 2021, 6:18am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/4 "2021-08-19T06:18:32Z")
Now I have pass the TXT validation, but I have another trouble: ```nohighlight { “type”: “urn:ietf:params:acme:error:unauthorized”, “detail”: “Error finalizing order :: Order includes different number of names than CSR specifies”, “status”: 403 } ``` I am confused about how to generate a CSR correctly. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 19, 2021, 6:34am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/5 "2021-08-19T06:34:59Z")
> [@250king](#): > > I am confused about how to generate a CSR correctly. How do you generate the CSR files? [maybe someone can spot the needed modification to that step] ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [August 19, 2021, 6:37am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/6 "2021-08-19T06:37:02Z")
> [@250king](#): > > `Order includes different number of names than CSR specifies` It would also help if we knew which ACME client software you are using. Not certbot? ---
**Author:** ![250king](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/250king/32/48809_2.png) [@250king](https://community.letsencrypt.org/u/250king)\ **Post date:** [August 19, 2021, 6:52am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/7 "2021-08-19T06:52:16Z")
OpenSSL ---
**Author:** ![250king](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/250king/32/48809_2.png) [@250king](https://community.letsencrypt.org/u/250king)\ **Post date:** [August 19, 2021, 6:53am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/8 "2021-08-19T06:53:10Z")
My Python program ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 19, 2021, 6:56am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/9 "2021-08-19T06:56:14Z")
> [@250king](#): > > OpenSSL Could you provide the complete command used? Otherwise, my only response can be: You are using the right program. ---
**Author:** ![250king](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/250king/32/48809_2.png) [@250king](https://community.letsencrypt.org/u/250king)\ **Post date:** [August 19, 2021, 7:09am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/10 "2021-08-19T07:09:47Z")
![image](https://global.discourse-cdn.com/letsencrypt/original/3X/1/f/1f17014f68f81d084ffccb85f830a33f3ce07a92.png) ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 19, 2021, 7:20am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/12 "2021-08-19T07:20:02Z")
Here are some instructions I found online on how to add the multiple names into CSR (SAN field): > **[Steps to generate CSR for SAN certificate with openssl | GoLinuxCloud](https://www.golinuxcloud.com/openssl-subject-alternative-name/)** > > Step by step instruction to generate Certificate Signing Request (CSR) for Subject Alternative Name (SAN) certificates using openssl with examples in Linux ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [August 19, 2021, 7:39am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/13 "2021-08-19T07:39:52Z")
I'm puzzled here.. What are you, in the grand scheme of things, trying to achieve? There are literally more than a dozen ACME clients out there. What's the reason why you're using OpenSSL to generate the CSR in combination with "[your] Python program", whatever that may be? ---
**Author:** ![250king](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/250king/32/48809_2.png) [@250king](https://community.letsencrypt.org/u/250king)\ **Post date:** [August 19, 2021, 7:48am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/14 "2021-08-19T07:48:09Z")
![image](https://global.discourse-cdn.com/letsencrypt/original/3X/d/1/d155fc7bc72c1b89848af29ddfaaaf953af93907.png) ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 19, 2021, 7:49am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/15 "2021-08-19T07:49:53Z")
If that can be automated, then you are done 🙂 Cheers from Miami 🍻 #FreeCUBA ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [September 18, 2021, 7:50am UTC](https://community.letsencrypt.org/t/there-is-no-root-domain-in-the-wildcard-certificate/158114/16 "2021-09-18T07:50:35Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.