Unwanted SSL wild card DNS entry

Virtualmin
1
SYSTEM INFORMATION
OS type and version Ubuntu Linux 22.04.5
Usermin version 2.400
Usermin version 2.510
Virtualmin version 7.40.1 Pro
Theme version 25.10
Apache version 2.4.52
Package updates 11 package updates are available

In my DNS records I have this line, but I don’t use wildcards

image

Questions

  • Where do I enable/disable wildcards? I can’t remember.
  • Should this record be present if I do not have wildcards enabled for this domain?
2

in the ssl providers tab on virtualmin → domain → manage virtualserver → Setup SSL Certificate

I shouldn’t worry about it, all my domains have it, my guess it’s added by virtualmin just in case you add a wildcard

3

thanks for the pointers.

4

That has nothing to do with wildcards. It’s a security feature.

1 Like
5

issuewild is for wildcard certs.
issue is for regular certs

6

So, yes, but it’s about who can sign certs for your domain (wildcard or otherwise). It is not about whether you have wildcard certs.

But, it is surprising that we’re setting issuewild but not setting issue. Or are both present, and OP only posted about issuewild because they don’t have wildcards and was surprised to see that, maybe?

7

Part 1 solved, but should I have issuewild if I am not requesting a wild card.

I only have the CAA record.

8

it doesn’t hurt, but if you don’t have wildcards in this domain, remove it.
just keep one CAA record with `issue’ .

9

maybe if you select wild card ssl during ssl cert creation time, it creates just an issuewild record? (not sure about virtualmin part.)
this makes sense, you don’t need both CAA records if you create one wildcard for all subdomains.

10

https://letsencrypt.org/docs/caa/#the-issue-and-issuewild-properties

Records with the issue tag simply control whether a CA can issue certificates for this domain and its subdomains. Generally this is the only record you need, as it controls both normal (e.g. “example.org”) and wildcard (e.g. “*.example.org”) issuance in the absence of any other records.

issue + letsencrypt.org = only allows letsencrypt.org to issue certs for my server

Records with the issuewild tag control whether a CA can issue wildcard certificates (e.g. “*.example.org”). You only need to use issuewild records if you want different permissions for wildcard and non-wildcard issuance.

This section is confusing and seems to make out issuewild is pointless. The descriptions here is not the best unless I am reading it wrong.

Is it for allowing a different provider to provide the wildcard cert as opposed to domain specific ones?

11

exactly. you could have providerA for wildcards and another cert providerB for a specific (sub)domain. you’d need both CAA records in this case. issuewild for A and issue for B.
for virtualmin, i guess issue is enough for most common scenarios.

12

Posted it here. A small issue to go on the list.