DEV Community

Cover image for How to Get a Free Wildcard SSL Certificate Without Installing Anything
Fizee
Fizee

Posted on AI-assisted

How to Get a Free Wildcard SSL Certificate Without Installing Anything

#security #devops #tutorial #webdev

If you're running a website with multiple subdomains, managing HTTPS certificates can quickly become annoying.

Imagine you have a project with these domains:

example.com
www.example.com
api.example.com
admin.example.com
docs.example.com
Enter fullscreen mode Exit fullscreen mode

You could request a separate SSL certificate for each subdomain, but there's a simpler option: a wildcard SSL certificate.

And you don't have to pay for one or install anything on your server.

In this tutorial, I'll show you how to request a free wildcard SSL certificate directly from your browser, verify domain ownership through DNS, and install the certificate on Nginx.

What Is a Wildcard SSL Certificate?

A wildcard certificate lets you secure multiple first-level subdomains with a single certificate.

For example:

*.example.com
Enter fullscreen mode Exit fullscreen mode

covers:

www.example.com
api.example.com
admin.example.com
docs.example.com
Enter fullscreen mode Exit fullscreen mode

But there's an important distinction.

A wildcard certificate for *.example.com does not automatically cover:

example.com
dev.api.example.com
Enter fullscreen mode Exit fullscreen mode

The root domain must be explicitly included, and deeper subdomains require additional coverage.

For projects with several first-level subdomains, a wildcard certificate can make HTTPS configuration easier to manage.

Step 1: Open the Free SSL Certificate Tool

We'll use this browser-based tool:

https://lapsezero.com/tools/free-ssl-certificate?utm_source=devto&utm_medium=community&utm_campaign=free-wildcard-ssl

It supports both single-domain and wildcard certificates.

You don't need to:

  • Create an account
  • Install Certbot or another CLI tool
  • Configure a web server before requesting the certificate
  • Upload your private key

The private key is generated locally in your browser and isn't uploaded to the service.

Wildcard certificate request form

The screenshots use my test domain ssl-guide.hxkit.com; replace it with your own domain.

Step 2: Enter Your Domain

Select Wildcard certificate and enter your domain:

example.com
Enter fullscreen mode Exit fullscreen mode

The tool will request a certificate covering:

*.example.com
example.com
Enter fullscreen mode Exit fullscreen mode

The root domain is included by default, but you can exclude it if you don't need it.

For the key type, RSA 2048 is a reasonable default if compatibility is your priority.

Then continue to DNS verification.

Step 3: Verify Domain Ownership Using DNS

Before a certificate can be issued, you must prove that you control the domain.

For wildcard certificates, this is done through DNS verification.

The tool displays the DNS TXT records to add. When you include both the wildcard and the base domain, add both values as separate TXT records with the same name; do not replace the first with the second.

It will look something like this:

Type: TXT
Name: _acme-challenge.example.com
Value: <verification-value>
Enter fullscreen mode Exit fullscreen mode

The actual verification value is generated for your request. Use the exact record shown on the page.

Open your DNS provider's dashboard, such as Cloudflare, Route 53, or another DNS service, and create the TXT record.

One thing to watch out for: some DNS providers automatically append your domain to the record name.

For example, you might only need to enter _acme-challenge instead of the full hostname.

Two DNS TXT values for wildcard and base-domain verification

Once the record is saved, give DNS a little time to propagate.

You can check it from your terminal:

dig TXT _acme-challenge.example.com
Enter fullscreen mode Exit fullscreen mode

If the expected value appears in the result, your DNS record is visible to that resolver.

You can then return to the tool and continue the verification process.

Step 4: Download Your Certificate

Once verification is successful and the certificate has been issued, download the certificate files.

For a typical Nginx deployment, you'll need:

  • A full-chain certificate
  • The matching private key

Issued certificate and download options

Keep the private key secure. Never commit it to a public Git repository or include it in a frontend application.

Step 5: Configure HTTPS in Nginx

Assume you've copied the certificate files to:

/etc/nginx/ssl/fullchain.pem
/etc/nginx/ssl/privkey.pem
Enter fullscreen mode Exit fullscreen mode

Your Nginx configuration might look like this:

server {
    listen 443 ssl;
    server_name api.example.com;

    ssl_certificate /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
    }
}
Enter fullscreen mode Exit fullscreen mode

Adjust the domain, certificate paths, and upstream address for your application.

Test your configuration:

sudo nginx -t
Enter fullscreen mode Exit fullscreen mode

Then reload Nginx:

sudo systemctl reload nginx
Enter fullscreen mode Exit fullscreen mode

That's it. Your application can now serve HTTPS using the certificate.

The same wildcard certificate can be used for other matching subdomains, provided each server is configured with the certificate and its private key.

Remember that sharing a private key across multiple servers also increases the impact if one server is compromised.

What About Certificate Renewal?

The certificate issued for this walkthrough is valid for about 90 days. Check the expiry date on your own certificate.

If you're managing a single project, requesting and deploying a replacement certificate manually may be fine.

For production applications with multiple domains or deployment targets, automatic renewal and deployment are a better long-term solution.

Tools such as Certbot and acme.sh are excellent options if you prefer managing automation yourself.

The tool used in this tutorial is part of LapseZero, a certificate automation project I'm building. I made the free certificate request tool available without requiring an account because sometimes you just need a certificate and want to get on with your project.

Try it here:

https://lapsezero.com/tools/free-ssl-certificate?utm_source=devto&utm_medium=community&utm_campaign=free-wildcard-ssl

If you run into issues with DNS verification or certificate installation, I'd be interested to hear about them.

Top comments (0)