# Wildcards for more than just base domains

**URL:** <https://community.letsencrypt.org/t/wildcards-for-more-than-just-base-domains/40679>\
**Category:** Feature Requests\
**Created:** [August 22, 2017, 11:03am UTC](https://community.letsencrypt.org/t/wildcards-for-more-than-just-base-domains/40679 "2017-08-22T11:03:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DaveP1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/davep1/32/15755_2.png) [@DaveP1](https://community.letsencrypt.org/u/DaveP1)\
**Post date:** [August 22, 2017, 11:03am UTC](https://community.letsencrypt.org/t/wildcards-for-more-than-just-base-domains/40679/1 "2017-08-22T11:03:51Z")

</div>

We run a series of services all of the format:

\*.service.common.org

So we have a need for wildcards for more than just base domains.

Any idea if/when that would be considered for support?

---

<div class="post-metadata">

**Author:** ![pfg](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pfg/32/1924_2.png) [@pfg](https://community.letsencrypt.org/u/pfg)\
**Post date:** [August 22, 2017, 12:40pm UTC](https://community.letsencrypt.org/t/wildcards-for-more-than-just-base-domains/40679/2 "2017-08-22T12:40:22Z")

</div>

My understanding is that this will be supported with the initial launch in January.

I'm assuming the question is due to this sentence in the announcement:

> We will initially only support base domain validation via DNS for wildcard certificates, but may explore additional validation options over time.

What this means is that in order to obtain a wildcard certificate, you will need to solve a challenge for the part of your domain excluding the wildcard symbol - in your example, that would be `service.common.org`.

What you can't do is verify ownership using the HTTP or TLS-SNI challenge, or using a subdomain _below_ the base domain.

---

<div class="post-metadata">

**Author:** ![tialaramex](https://avatars.discourse-cdn.com/v4/letter/t/f08c70/32.png) [@tialaramex](https://community.letsencrypt.org/u/tialaramex)\
**Post date:** [August 22, 2017, 12:42pm UTC](https://community.letsencrypt.org/t/wildcards-for-more-than-just-base-domains/40679/3 "2017-08-22T12:42:13Z")

</div>

As I understand it, Let’s Encrypt will be happy to issue this wildcard (once wildcards are supported). You will need to use DNS (the dns-01 challenge type) to prove control over the (sub) domain the wildcard is for.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [September 21, 2017, 12:42pm UTC](https://community.letsencrypt.org/t/wildcards-for-more-than-just-base-domains/40679/4 "2017-09-21T12:42:24Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.