Configure Wildcard Certificate using LetsEncrypt and ACME

Help! (Home for newbies)
21

I would never consider a single dns server but it seems to work for some

22

First up: You almost certainly should not use wildcard certs. They have security implications and are more difficult to validate. There is no reason to use them, you can get as many certs as you need for all the domains and subdomains you’ll be using, no reason to use wildcards in the vast majority of cases.

Second: You decided in your DNS propagation thread to not host DNS on the Virtualmin server. So, Virtualmin cannot request wildcard certificates for you, because it requires DNS validation to get a wildcard cert from Let’s Encrypt (that’s the only way to prove you own the zone and not just one name in the zone).

You can have Virtualmin create a certificate for every subdomain, assuming Virtualmin is managing every subdomain. If it is merely an alias and you’re application decides what to serve based on the name, that can still work in Virtualmin without DNS validation
just add all the aliases to the certificate for the domain. A regular (non-wildcard) certificate can have a bunch of names associated with it, and Virtualmin will offer to do that for Aliases, and it should work fine assuming you have DNS working correctly for all those names.

If you must use a wildcard, just use the certbot standalone mode, in interactive mode. I don’t know what that script could do to make that workflow easier.

23

A CNAME has nothing to do with a certificate.

If Cloudflare was managing your DNS, you would have been able to get a wildcard certificate through them (they also offer certificates), probably automatically.

Likewise, if Virtualmin is managing your DNS, you can request wildcard certs through Virtualmin. But, we’ve established Virtualmin is not managing your DNS, so you need to use a manual process to request a wildcard certificat.

You can do that. It’s not hard. But, it’s a little less automatic than if Virtualmin is managing your DNS (again, a wildcard requires a DNS record for validation). The standard certbot can use various APIs, as well, to mostly automate it: User Guide — Certbot 2.12.0.dev0 documentation

Otherwise, you’d need to use certbot in standalone mode and manually add a TXT record with the validation information when that information is provided to you by certbot.

24

I’m looking for a wildcard domain to use with a reverse proxy and a few other things. I understand it’s less secure. Trouble is, I’m getting an error when I request it. Virtualmin is managing the dns locally. Should it all be automatic, or do I need to set it all up myself?

25

Make a new topic for new issues, and please don’t just say “it doesn’t work” or “I got an error”. We need to know the exact error, we can’t guess why it failed.

26

I successfully did this using ACME SH.
I followed this help here:
dnsapi · acmesh-official/acme.sh Wiki · GitHub and it was easy.
Thank you so much everyone

27

  • Enable Wildcard for a domain

  • Virtualmin → Web Configuration → Website Options → Website matches all sub-domains

    • Tooltip: If the virtual server’s DNS domain is hosted on this system, Virtualmin will also add the wildcard * DNS record when Yes is selected.
      image

  • How to add a wildcard or multi-domain SSL certificate – Virtualmin

  • Let’s Encrypt wildcard certificate - Virtualmin - Virtualmin Community

    • You cannot validate for a wildcard certificate without using DNS validation. And, you can’t use DNS validation if you aren’t managing DNS with Virtualmin.
    • You generally should not use wildcards. They have security implications on top of being more difficult to validate, if you’re not hosting your own DNS.
    • A website cannot be used to validate a wildcard cert with Let’s Encrypt.
28

We are talking about validating a wildcard certificate without webmin managing the dns so there is no point giving instruction on how to do it assuming webmin is managing the dns

29

His software is Virtualmin 7.10.0, says so at the top.

Also

Using Webmin/Virtualmin, I have not been able to get Letencyrpt to issue widlcard certs
 It keeps giving me one error or the other.

Why would you use Webmin if it can be done easily in Virtualmin?

30

It’s the same difference webmin/virtualmin but it is apparent in the thread dns is else where hence the need for a thrid party script to obtain the certificate

31

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.