Automating Wildcard TLS Certificates with Let's Encrypt DNS-01 and Certbot Hooks

Standard Let's Encrypt certificates issued via HTTP-01 challenges require an active web server listening on port 80 of a public IP address. While convenient for basic websites, HTTP-01 cannot issue wildcard certificates (*.example.com) and cannot provision certificates for private servers, database administration panels, or internal VPN gateways shielded behind firewalls.

The DNS-01 challenge solves both constraints. Instead of serving an HTTP token file, Certbot writes a cryptographic challenge token to a DNS TXT record named _acme-challenge.example.com. Let's Encrypt verifies control of the domain by querying authoritative nameservers, allowing administrators to issue wildcard certificates for arbitrary private infrastructure.

Under the ACME protocol, when Certbot requests a wildcard certificate for *.example.com and the root apex example.com, the Let's Encrypt ACME server generates two distinct cryptographic challenge tokens. The client must publish both tokens as TXT values under the same DNS label _acme-challenge.example.com. Once Let's Encrypt resolves these TXT records across global authoritative nameservers, it signs a single certificate containing both Subject Alternative Names (SANs).

Expand

Creating Automated DNS Authentication and Cleanup Hooks

Certbot supports manual hook scripts that interact with your DNS provider's REST API. Create /usr/local/bin/certbot-dns-auth.sh:

#!/usr/bin/env bash
# /usr/local/bin/certbot-dns-auth.sh
set -euo pipefail

# CERTBOT_DOMAIN and CERTBOT_VALIDATION are injected by Certbot
RECORD_NAME="_acme-challenge"
TOKEN="$CERTBOT_VALIDATION"

echo "Setting DNS TXT record for $CERTBOT_DOMAIN..."

# Call your DNS provider API to add or update TXT record
curl -s -X POST "https://api.dns-provider.com/v1/zones/$CERTBOT_DOMAIN/records"      -H "Authorization: Bearer $DNS_API_KEY"      -H "Content-Type: application/json"      -d "{"type":"TXT","name":"$RECORD_NAME","content":"$TOKEN","ttl":60}"

# Sleep briefly to ensure DNS propagation across authoritative nodes
sleep 25

Create the corresponding cleanup hook /usr/local/bin/certbot-dns-cleanup.sh:

#!/usr/bin/env bash
# /usr/local/bin/certbot-dns-cleanup.sh
set -euo pipefail

echo "Cleaning up DNS TXT record for $CERTBOT_DOMAIN..."
curl -s -X DELETE "https://api.dns-provider.com/v1/zones/$CERTBOT_DOMAIN/records/_acme-challenge"      -H "Authorization: Bearer $DNS_API_KEY"

Make both hook scripts executable:

sudo chmod 700 /usr/local/bin/certbot-dns-auth.sh /usr/local/bin/certbot-dns-cleanup.sh

Notice the sleep 25 statement in the auth hook. Because authoritative DNS nameservers can require several seconds to replicate newly created records across all secondary nodes, adding a brief propagation delay prevents premature challenge verification failures from Let's Encrypt validation probes.

Requesting the Wildcard Certificate

Execute Certbot specifying the manual auth and cleanup hooks:

sudo DNS_API_KEY="secret-token-here" certbot certonly   --manual   --manual-auth-hook /usr/local/bin/certbot-dns-auth.sh   --manual-cleanup-hook /usr/local/bin/certbot-dns-cleanup.sh   --preferred-challenges dns   --server https://acme-v02.api.letsencrypt.org/directory   -d "example.com"   -d "*.example.com"   --agree-tos   -m admin@example.com   --non-interactive

Automating Silent Renewals via Systemd

Certbot installs a systemd timer (/lib/systemd/system/certbot.timer) that runs twice daily. Create a deploy hook in /etc/letsencrypt/renewal-hooks/deploy/reload-web.sh to reload your web servers when a certificate successfully renews:

#!/usr/bin/env bash
systemctl reload nginx || systemctl reload caddy

Make the renewal hook executable with chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-web.sh. When the certificate enters its 30-day renewal window, Certbot will automatically execute the DNS-01 auth hook, verify the domain, store the new certificate in /etc/letsencrypt/live/example.com/, and trigger the deploy hook to reload your web services with zero human intervention.

Automated DNS-01 challenges make managing secure wildcard certificates across private and public infrastructure completely hands-free.

You can spin up an Ubuntu 24.04 instance on Netbay in under 60 seconds with Intel Xeon Platinum compute and high-speed SSD storage in Lucknow — netbayhosts.in.