Get a Let’s Encrypt Wildcard SSL with Cloudflare DNS

This guide walks you through getting a free Let’s Encrypt wildcard SSL certificate for your domain using Cloudflare’s DNS for the required DNS-01 challenge. You’ll end up with a certificate that secures your main domain and all of its subdomains, automatically renewing, without needing to touch your web server configuration for each new subdomain.

What You’ll Need

• A domain name with its DNS managed by Cloudflare (free plan is fine).
• Your Cloudflare account email address and a Global API Key (or a scoped API token with Zone:Read and DNS:Edit permissions).
• Access to a terminal or command line on the machine where you’ll run the certificate request (usually your web server).
• Certbot installed (the official Let’s Encrypt client). If not installed, you’ll install it in the steps below.
• Python 3 and pip (usually already present on modern systems).

Step-by-Step

1. Install Certbot and the Cloudflare plugin. On Ubuntu/Debian: sudo apt update && sudo apt install certbot python3-certbot-dns-cloudflare. On CentOS/RHEL: sudo dnf install certbot python3-certbot-dns-cloudflare. On macOS (Homebrew): brew install certbot && pip3 install certbot-dns-cloudflare.
2. Create a Cloudflare API token. Log in to Cloudflare, go to My Profile → API Tokens → Create Token. Use the “Edit zone DNS” template, select your domain under Zone Resources, and create the token. Copy it immediately – it’s shown only once. Alternatively, you can use your Global API Key (found in My Profile → API Tokens → Global API Key), but a scoped token is safer.
3. Store the credentials securely. Create a file to hold your Cloudflare credentials: sudo mkdir -p /etc/letsencrypt && sudo nano /etc/letsencrypt/cloudflare.ini. Add the following (replace with your actual email and token):

   dns_cloudflare_api_token = YOUR_API_TOKEN

   If you’re using a Global API Key, use:

   dns_cloudflare_email = your@email.com
   dns_cloudflare_api_key = YOUR_GLOBAL_API_KEY

   Save the file, then secure it: sudo chmod 600 /etc/letsencrypt/cloudflare.ini.

4. Request the wildcard certificate. Run the following command, replacing example.com with your actual domain:

   sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini -d '*.example.com' -d 'example.com' --email your@email.com --agree-tos --no-eff-email

   The -d '*.example.com' covers all subdomains, and the additional -d 'example.com' covers the bare domain (some browsers don’t trust a wildcard for the root domain).

5. Wait for the challenge. Certbot will automatically create a TXT record in Cloudflare via the API, wait for DNS propagation, and then verify it. This usually takes 10-30 seconds. You’ll see output like “Successfully received certificate.”
6. Locate your certificate files. Your certificate and key are now in /etc/letsencrypt/live/example.com/ (replace with your domain). The important files are fullchain.pem and privkey.pem.
7. Configure your web server. Point your web server (Apache, Nginx, etc.) to these files. For example, in Nginx:

   ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

   Reload your server: sudo systemctl reload nginx (or apache2).

8. Set up automatic renewal. Certbot installs a systemd timer or cron job automatically. To test renewal, run sudo certbot renew --dry-run. If it succeeds, you’re done. The certificate will renew automatically every 60 days (Let’s Encrypt certificates last 90 days).

Common Mistakes

• Using the wrong API token permissions. The token must have DNS:Edit and Zone:Read permissions for your domain. If it doesn’t, Certbot will fail with a 403 error.
• Leaving the credentials file readable. If cloudflare.ini has permissions other than 600, Certbot will warn or refuse to run. Always chmod 600.
• Forgetting the bare domain. A wildcard *.example.com does NOT cover example.com. You must request both if you want the root domain secured.
• Using the wrong plugin. If you don’t install python3-certbot-dns-cloudflare, Certbot won’t recognize the --dns-cloudflare flag.
• Not waiting for propagation. Certbot handles this automatically, but if you’re manually testing with dig, remember that DNS changes can take a few minutes to propagate globally.

Tips

• Use a scoped API token instead of a Global API Key. It limits the damage if the credentials leak.
• Test renewal immediately after setup to ensure your cron job works. A dry-run doesn’t issue a new cert but validates the process.
• Keep the credentials file in a consistent location like /etc/letsencrypt so you can reference it easily in future commands.
• If you’re using Cloudflare’s proxy (orange cloud), you can still use this method. The DNS-01 challenge doesn’t require direct access to your server.
• For multiple domains, you can add more -d flags, but each domain must be in the same Cloudflare account.

Troubleshooting

• “No plugin named ‘dns-cloudflare’” – You didn’t install the plugin. Install python3-certbot-dns-cloudflare and try again.
• “Invalid credentials” or 403 error – Check your API token permissions and that the token is correctly copied. Also ensure the email in the file matches your Cloudflare account if using a Global API Key.
• “DNS problem: NXDOMAIN” – Your domain’s nameservers aren’t pointing to Cloudflare, or the domain is not active in Cloudflare. Verify your domain is listed in Cloudflare and that your registrar uses Cloudflare’s nameservers.
• “Certbot doesn’t have permission to write to /etc/letsencrypt” – Run the command with sudo.
• Renewal fails later – Check that the API token hasn’t been revoked. Also, if you changed your Cloudflare account password, the Global API Key changes, so update the credentials file.

Frequently Asked Questions

How long does the wildcard certificate last?

Let’s Encrypt certificates are valid for 90 days. Certbot automatically renews them when they’re 60 days old, so you don’t need to worry about it.

Does this work if my website is behind Cloudflare’s proxy (orange cloud)?

Yes. The DNS-01 challenge only adds a TXT record; it doesn’t require direct HTTP access to your server. The certificate will work fine behind the proxy.

Can I use this for a domain that’s not on Cloudflare?

No, this method specifically uses Cloudflare’s DNS API. For other DNS providers, you’d need a different plugin or manual DNS-01 challenge.

What if I have multiple domains in my Cloudflare account?

You can include them all in one command by adding more -d flags, as long as they’re all in the same Cloudflare account and you have permission to edit DNS for each.

Is the wildcard certificate valid for the bare domain too?

No, a wildcard *.example.com does not cover example.com. You must add -d example.com explicitly, as shown in the steps.

Can I revoke the certificate if I need to?

Yes, use sudo certbot revoke --cert-path /etc/letsencrypt/live/example.com/cert.pem. You can also delete the certificate with sudo certbot delete.

Related

• Hyperlink to First Match: How It Works
• x509 Certificate & OpenSSL Commands Explained
• Physical Backup: NAS vs Tape Storage