# Install a wildcard certificate with Let's Encrypt
Source: https://docs.webgee.com/en/security-ssl/how-do-i-install-a-wildcard-ssl-certificate-via-letsencrypt







Issue a certificate covering `*.example.com` — every subdomain, including ones
created later. Applies to shared, reseller and Premium hosting.

For an ordinary certificate you need do nothing; AutoSSL handles it. Use this
when you specifically need a **wildcard**, which AutoSSL cannot issue.

## When Let's Encrypt is the right choice [#when-lets-encrypt-is-the-right-choice]

* **Wildcard coverage** — one certificate for all subdomains.
* **Your domain is in a region Sectigo cannot serve.** AutoSSL uses Sectigo,
  which is subject to US export restrictions — see
  [Install a free SSL certificate](/en/security-ssl/free-ssl-certificate).
* **The site sits behind Cloudflare or another proxy.** Let's Encrypt follows
  redirects during validation, which is often simpler in that setup.

Otherwise AutoSSL is preferable: it renews automatically with no involvement from
you, and does not rate-limit issuance.

## Issue one [#issue-one]

1. In cPanel, open **Let's Encrypt™ SSL**.

   <img alt="The Let's Encrypt SSL interface listing issued certificates" src="__img0" />

   The upper section lists certificates already issued, with expiry dates and
   options to reinstall, view or remove them.

2. In the lower section, find the domain you want to cover.

   <img alt="The list of domains eligible for issuance" src="__img1" />

3. Issue the certificate, including the wildcard entry for the domain.

## Two things that block issuance [#two-things-that-block-issuance]

<Callout type="warn">
  Both must be true or issuance fails, usually with a validation error that does
  not say which one is the problem.
</Callout>

**The domain must resolve to this server.** Validation works by proving control,
which means fetching something from your account. A domain still pointing at a
previous host cannot be validated — see
[Check which nameservers a domain uses](/en/domains-dns/how-do-i-check-what-nameservers-my-domain-is-using).

**Redirected domains cannot be issued a certificate.** A domain configured as a
redirect in cPanel has nowhere to serve the validation file from. Remove the
redirect, issue the certificate, then reapply it.

## Wildcards need DNS validation [#wildcards-need-dns-validation]

A wildcard cannot be validated by fetching a file — there is no single hostname
to fetch it from. Validation is done with a DNS `TXT` record instead.

Where your DNS is hosted **in cPanel**, this is automatic. Where it is hosted
elsewhere — Cloudflare, or a registrar — you must add the `TXT` record there
manually when prompted, within the time the process allows.

## Check it worked [#check-it-worked]

```bash
echo | openssl s_client -connect anything.example.com:443 2>/dev/null \
  | openssl x509 -noout -subject -dates
```

The subject should show the wildcard, and the dates should be current. Or simply
visit a subdomain that has no certificate of its own and confirm it loads without
a warning.

## Renewals [#renewals]

Let's Encrypt certificates last 90 days and renew automatically, provided the
prerequisites above still hold. A domain that later moves away, or gains a
redirect, will fail to renew silently — the first sign is usually an expiry
warning in a browser.

## Related [#related]

* [Install a free SSL certificate](/en/security-ssl/free-ssl-certificate)
* [Create a wildcard subdomain](/en/hosting/how-to-add-wildcard-subdomain-through-cpanel)
* [Force HTTPS on your site](/en/security-ssl/force-https)