Deploy a wildcard certificate
A wildcard certificate (*.example.com) secures all same-level subdomains — new subdomains need no re-issue. This is the full flow from request and validation to deployment and distribution.
1. Generate a CSR (Common Name *.example.com)
openssl genpkey -algorithm RSA -out wildcard.key -pkeyopt rsa_keygen_bits:2048 openssl req -new -key wildcard.key -out wildcard.csr
Set the Common Name to *.example.com. To also protect the bare domain, add example.com to the SAN when requesting.
2. Complete DNS validation
Wildcards can only be issued via DNS validation: add the TXT record provided by the CA, wait for propagation, then check:
dig TXT _dnsauth.example.com
3. Coverage
- *.example.com covers first-level subdomains like a.example.com, b.example.com;
- it does not cover the bare example.com (unless added to the SAN);
- it does not cover multi-level subdomains like a.b.example.com.
4. Deploy
Combine the server and intermediate certificates into a chain and deploy with the key (Nginx shown):
cat wildcard.crt chain.crt > fullchain.crt
ssl_certificate /etc/nginx/ssl/fullchain.crt; ssl_certificate_key /etc/nginx/ssl/wildcard.key;
5. Distribute to multiple servers
scp fullchain.crt wildcard.key web01:/etc/nginx/ssl/ ssh web01 nginx -s reload
6. Backup
Back up wildcard.key and the certificate. Since one certificate covers many servers, key security is especially important — restrict access strictly.