A normal SSL certificate covers one domain name. A wildcard certificate covers that domain and every subdomain under it: app.example.com, api.example.com, blog.example.com, and any subdomain you invent next year. For a self-hoster or a startup with many services, that difference is worth real money, because commercial wildcard certificates cost $50 to $200 a year. Let's Encrypt issues them free, and the only price is a slightly more involved setup.

The difference from a normal certificate is the validation method. A standard certificate can be validated over HTTP: the certificate authority asks your server to serve a file, and if it can, you own the domain. A wildcard certificate requires DNS validation instead, because there is no single server to check. Let's Encrypt asks you to create a TXT record in your domain's DNS, proves you control the domain, and then issues the certificate. That DNS step is the whole challenge, and it is the step most guides rush past.

The practical setup uses a DNS plugin for your certificate tool. Certbot, the most common Let's Encrypt client, has plugins for Cloudflare, Route53, DigitalOcean, and most other DNS providers. The plugin creates the TXT record automatically, waits for it to propagate, and deletes it after validation. The command is one line, and the certificate lands in the same directory as any other. If your DNS provider has no plugin, you can create the record manually, but then renewal cannot be automated, which defeats the purpose.

Renewal is where wildcard certificates fail. Let's Encrypt certificates last 90 days, so the renewal must run automatically, usually twice a day from a cron job or a systemd timer. The renewal redoes the DNS validation each time, which means the API credentials for your DNS provider must stay valid and the plugin must keep working. Test the renewal with a dry run before you rely on it, and set an expiry alert for 30 days before the certificate lapses. A wildcard certificate that expires takes down every subdomain at once, which is the price of the convenience.

There is one more option worth knowing. If you use Cloudflare as your DNS and proxy, Cloudflare issues its own free edge certificate that already covers your domain and one level of subdomains, with no setup at all. That covers most small projects without touching Let's Encrypt. The Let's Encrypt wildcard matters when you terminate TLS on your own server, when you need a certificate for a subdomain Cloudflare does not proxy, or when you want the certificate file itself for a service that does not sit behind Cloudflare.

For most self-hosters, the setup is: one wildcard certificate, one automated renewal, and one monitoring alert. The total cost is zero, the total maintenance is a few minutes a year, and every new service you launch is already covered the moment you point its subdomain at the server. That is the real value of a wildcard: not the money saved, but the friction removed from every future project.

A common mistake is requesting a separate certificate for every subdomain instead of one wildcard. That works until the subdomain count grows, and then renewal becomes a list of certificates to track instead of one. The wildcard also simplifies automation: a single renewal job, a single expiry alert, and a single file to distribute to every service on the server. If you run a reverse proxy, terminate TLS there with the wildcard and let the internal services run plain HTTP on a private network, which keeps the certificate management in exactly one place.