How to Get a Free Wildcard SSL Certificate

A wildcard SSL certificate secures a domain and all its subdomains with a single certificate. For example, *.example.com covers www.example.com, blog.example.com, api.example.com, and any other subdomain — without listing each one individually.

With GetHTTPS, you can get a wildcard certificate from Let’s Encrypt for free. Most competitors (ZeroSSL, SSL For Free) charge for wildcard certificates.

Prerequisites

• A domain name you want to secure with a wildcard (e.g., example.com)
• Access to your domain’s DNS settings — wildcard certificates require DNS-01 validation (HTTP-01 doesn’t work for wildcards)
• A modern browser

Why DNS-01 only? HTTP-01 challenge validates a single hostname by placing a file at http://hostname/.well-known/acme-challenge/.... A wildcard covers infinite subdomains, so there’s no single server to place the file on. DNS-01 proves control of the entire domain through a DNS TXT record.

Step 1: Open GetHTTPS

Go to gethttps.com/app/setup. An account key and certificate key will be generated automatically in your browser.

Step 2: Enter your wildcard domain

Enter *.example.com (replace example.com with your domain).

Common configurations:

Important: A wildcard certificate for *.example.com does not cover example.com itself (the bare domain). If you want both, add example.com as a separate name — GetHTTPS will handle both in one certificate.

Step 3: Add the DNS TXT record

GetHTTPS will show you a DNS TXT record to create:

• Record name: _acme-challenge.example.com
• Record value: A long random string (different each time)
• Record type: TXT

Add this record in your DNS provider:

Cloudflare

1. Go to DNS → Records → Add record
2. Type: TXT
3. Name: _acme-challenge (Cloudflare auto-appends your domain)
4. Content: paste the value from GetHTTPS
5. TTL: Auto
6. Click Save

AWS Route 53

1. Go to Hosted zones → select your domain
2. Click Create record
3. Record name: _acme-challenge
4. Record type: TXT
5. Value: "paste-value-here" (include the quotes)
6. Click Create records

GoDaddy

1. Go to DNS Management
2. Click Add under Records
3. Type: TXT
4. Name: _acme-challenge
5. Value: paste the value from GetHTTPS
6. TTL: 1 Hour
7. Click Save

Namecheap

1. Go to Domain List → Manage → Advanced DNS
2. Click Add new record
3. Type: TXT
4. Host: _acme-challenge
5. Value: paste the value from GetHTTPS
6. TTL: Automatic
7. Click Save all changes

Step 4: Wait for DNS propagation

DNS changes take 1-5 minutes to propagate globally, sometimes longer depending on your provider and TTL settings.

GetHTTPS’s pre-check feature queries public DNS (via Google’s DNS-over-HTTPS) to verify your TXT record is visible before submitting to Let’s Encrypt. Wait until the pre-check passes before clicking Verify.

Step 5: Verify and download

Once the pre-check confirms your DNS record, click Verify. Let’s Encrypt will validate the challenge and issue your wildcard certificate.

Download all four files:

• privkey.pem — your private key (keep secret)
• cert.pem — your wildcard certificate
• chain.pem — intermediate certificate
• fullchain.pem — cert + chain (most servers need this)

Step 6: Install the wildcard certificate

The installation is the same as any SSL certificate. Use fullchain.pem and privkey.pem:

Nginx:

server {
    listen 443 ssl http2;
    server_name *.example.com example.com;

    ssl_certificate     /etc/ssl/fullchain.pem;
    ssl_certificate_key /etc/ssl/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
}

Apache:

<VirtualHost *:443>
    ServerName example.com
    ServerAlias *.example.com

    SSLEngine on
    SSLCertificateFile      /etc/ssl/cert.pem
    SSLCertificateKeyFile   /etc/ssl/privkey.pem
    SSLCertificateChainFile /etc/ssl/chain.pem
</VirtualHost>

Cleanup

After your certificate is issued, you can delete the _acme-challenge TXT record from your DNS. It’s only needed during validation. You’ll create a new one when you renew.

Why GetHTTPS for wildcards?

Most browser-based SSL tools charge for wildcard certificates:

GetHTTPS is the only browser-based tool that offers free wildcard certificates. No installation, no CLI, no root access needed — just DNS access.

Common mistakes

Adding *.example.com but forgetting example.com

A wildcard covers subdomains but not the bare domain. If you only get *.example.com, visitors to https://example.com (without www) will see a certificate error. Always add both.

Not waiting for DNS propagation

DNS changes can take 1-30 minutes depending on your provider and TTL settings. Don’t click Verify too quickly — GetHTTPS’s pre-check will tell you when the record is visible.

Creating a CNAME instead of a TXT record

The challenge record must be TXT type, not CNAME, not A, not AAAA. Some DNS UIs default to a different type — double-check before saving.

Leaving old _acme-challenge records

If you have a stale _acme-challenge TXT record from a previous certificate, delete it before adding the new one. Multiple TXT records for the same name can confuse validation.

Frequently asked questions

Does *.example.com cover example.com (bare domain)?

No. A wildcard certificate for *.example.com covers www.example.com, blog.example.com, etc., but not example.com itself. Add both *.example.com and example.com in GetHTTPS to cover both.

Does it cover sub-subdomains like a.b.example.com?

No. *.example.com only covers one level of subdomain. For *.sub.example.com, you’d need a separate wildcard.

Can I get a wildcard certificate for free from ZeroSSL?

No. ZeroSSL restricts wildcard certificates to paid plans. Let’s Encrypt (via GetHTTPS) offers wildcard certificates at no cost.

How often do I need to renew?

Every 90 days, same as any Let’s Encrypt certificate. You’ll need to create a new DNS TXT record for each renewal. With the upcoming 47-day validity limit (by 2029), this will become more frequent.

Is DNS-01 safe? I’m modifying my DNS.

Yes. You’re only adding a TXT record — it doesn’t affect your website’s traffic, email, or any other DNS records. The _acme-challenge subdomain is specifically designed for ACME validation.