Wildcard certificate for hosted and in-house server

[JeffBecker2101]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:certbot certonly --standalone -d *.$DOMAIN -d $DOMAIN --preferred-challenges http --agree-tos --rsa-key-size 4096

It produced this output: Client with currently selected authenticator does not support any combinations of challenges that will satisfy CA. You may need to use an authenticator plugin that can do challenges over DNS.

My web server is (include version): Apache 2.4

The operating system my web server runs on is (include version): Ubuntu Linux

My hosting provider, if applicable, is: NameCheap and my own server (in office)

I can login to a root shell on my machine (yes or no, or I don't know): yes in office, no on NameCheap

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Yes for some subdomains, no for others

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): CertBot 5.0.0

The problem is that I can't use a DNS challenge because of the hosting restrictions. I've succeeded in downloading (but not renewing) a certificate for the root domain using an http challenge but apparently the command that succeeds on the root domain only won't work for a wildcard. I could set up the necessary sub-domains separately but I'd prefer wildcards.

[webprofusion]

Yeah you have to use a DNS challenge to get a wildcard, that's just the rules.

Assuming your DNS hosting provider for your domain is Namecheap, you should be able to find a namecheap DNS plugin for certbot, or use a different client like lego which definitely has heaps of DNS providers.

[rmbolger]

Isn't Namecheap one of the registrars that doesn't allow API access unless you've purchased some minimum number of domains or spent some minimum amount of money with them?

That said, there's nothing stopping @JeffBecker2101 from moving the DNS hosting for the domain(s) to a different DNS provider while leaving the domain registration with Namecheap. I actually recommend separating your registrar from your DNS provider in general. Registrar provided DNS is often terrible relative to anything else out there free or otherwise.

[webprofusion]

There is no greater freedom than basically just using Cloudflare