How to Get a Free Wildcard SSL Certificate

A wildcard SSL certificate covers every first-level subdomain of a domain with a single certificate — *.example.com secures www.example.com, shop.example.com, api.example.com and so on. Let's Encrypt issues wildcard certificates for free, and with MTFreeSSL you can get one without installing Certbot or touching your web server.

What a wildcard certificate covers

Hostname	Covered by *.example.com?
www.example.com	Yes
blog.example.com	Yes
example.com (the bare domain)	No — needs its own certificate
dev.api.example.com	No — wildcards match one level only

Why wildcards need DNS verification

Let's Encrypt only issues wildcard certificates through the DNS-01 challenge. Instead of uploading a file to one website, you prove control of the whole domain by publishing a TXT record in its DNS. File-based (HTTP-01) verification cannot be used for wildcards.

Step-by-step

1. Create a free MTFreeSSL account and verify your email.
2. Click Generate SSL, enter *.example.com and choose DNS TXT Record as the verification method.
3. Leave staging on for a first test run; switch it off to get a browser-trusted certificate.
4. MTFreeSSL shows a record to add. At your DNS provider (Cloudflare, GoDaddy, Namecheap, Route 53, etc.) create:

   Type:  TXT
   Name:  _acme-challenge
   Value: (the value shown on the page)
   TTL:   lowest available, e.g. 60 or Auto

   Some providers want the full name, _acme-challenge.example.com.
5. Wait for the record to propagate, then confirm it is visible:

   dig TXT _acme-challenge.example.com +short

6. Click Verify. Once Let's Encrypt sees the record, the certificate is issued and you can download the ZIP.
7. Delete the TXT record afterwards — it is only needed during verification.

Installing the wildcard certificate

A wildcard certificate installs exactly like any other certificate. Use the same fullchain.pem and private.key on every server that hosts one of your subdomains:

• Install on Nginx
• Install on Apache
• Install on cPanel or shared hosting

Troubleshooting

• "Incorrect TXT record" — the record has not propagated yet or the value has extra quotes or spaces. Check with dig and wait a few minutes.
• Record shows as _acme-challenge.example.com.example.com — your provider appends the domain automatically; enter just _acme-challenge.
• Cloudflare — TXT records are never proxied, so no extra settings are needed.