HowTo: Let's Encrypt wildcard certificate with DNS-01

DNS-01 gives you wildcard certificates (*.domain) without opening port 80 — ideal for internal services. Issuance and auto-renewal, step by step.

1. Install certbot + DNS plugin

sudo apt -y install certbot python3-certbot-dns-cloudflare

2. DNS API credentials

# token API Cloudflare cu drept Edit pe zona DNS
sudo mkdir -p /etc/letsencrypt
sudo tee /etc/letsencrypt/cloudflare.ini >/dev/null <<'EOF'
dns_cloudflare_api_token = TOKEN_AICI
EOF
sudo chmod 600 /etc/letsencrypt/cloudflare.ini

3. Issue wildcard

# certificat WILDCARD (fara port 80 deschis!)
sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d 'example.com' -d '*.example.com' \
  --agree-tos -m admin@example.com --non-interactive

4. Auto-renewal

# reinnoire automata (certbot.timer ruleaza deja de 2x/zi)
sudo certbot renew --dry-run
# reincarca serviciul dupa reinnoire:
sudo certbot renew --deploy-hook 'systemctl reload nginx'

5. Verify

sudo certbot certificates
sudo openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -dates

Conclusion

You now have a wildcard certificate, auto-renewed, with no port-80 exposure — perfect for intranet. We configure it for you.