How to setup Certbot wildcard certificate on Apache
Trying to generate a wildcard certificate using Certbot for an Apache webserver?
The wildcard certificate authenticates the identity of a website and helps to encrypt the transferred data.
At Bobcares, we often receive requests to generate SSL certificates, as a part of our Server Management Services.
Today, we’ll see how our Support Engineers make use of Certbot to install SSL.
What is a Certbot generated wildcard certificate?
Let’s Encrypt is an open Certificate Authority(CA). It provides free certificates for Transport Layer Security (TLS) encryption.
Certbot is a tool for using Let’s encrypt on manually administered websites. And thereby it enables HTTPS.
Among many SSL certificates available today, a wildcard certificate will help to secure a domain and its subdomains.
To generate a valid wildcard certificate using Certbot, it involves multiple steps. Let’s see how our Support Engineers generate it using Certbot.
- Initially, we check whether the Certbot is previously installed on the server.
- Thereafter, we generate the certificate using Certbot
- Finally, we add the DNS TXT record for verification.
How to generate a wildcard certificate using Certbot?
Here, we use an Ubuntu 18.04 server with the Apache webserver running in it.
Installing Certbot in Apache
Usually, Certbot is not available in the default Ubuntu package manager repository. So we add the Certbot PPA using the commands,
apt update apt install software-properties-common add-apt-repository universe add-apt-repository ppa:certbot/certbot apt update
Later to install Certbot, we run,
apt install certbot python-certbot-apache
This installs Certbot and its dependencies.
Generating a wildcard certificate using Certbot
By running a single command we can generate a wildcard certificate.
For instance, the command used for an example domain is,
certbot certonly --manual --preferred-challenges=dns --email email@example.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d *.example.com
After executing the command, the prompt asks for certain questions. We reply to it with yes or no.
Finally, the prompt will provide a text string. We add this TXT record to the webserver’s DNS entry. The prompt appears as,
Adding TXT record
Then we configure the DNS server to add the TXT record to the domain.
The DNS record modification has a propagation delay. After this we press enter, so that Let’s encrypt can verify the domain. Finally, we receive a success message with the certificate location.
The location of the certificate will be,
And the location of the key will be at
For verifying, the certificate we use the following command.
It will provide the certificate name, domain name, expiry and certificate location. The certificate is valid for 90 days, therefore, we have to renew it before the expiry.
Then, we update the certificate locations in the Apache virtual host. And finally, we reload the Apache to load the new configuration.
Later, to automate the SSL renewal process, we add the certbot command in the crontab of the server.
[Need assistance to generate a wildcard certificate using Certbot? We’ll help you.]
In short, Certbot is a client that fetches certificates from Let’s Encrypt. Today, we saw how our Support Engineers generated a wildcard certificate using Certbot in an Apache webserver.