Wildcard SSL Certificates with LetsEncrypt

Wildcard SSL certificates are verified by LetsEncrypt using your DNS provider. It will look for a specific TXT record on your domain to prove ownership of the root domain (and therefore all the subdomains).

To do this, you'll need to provide an API key that can create, read, and delete DNS records on the domain.

After adding to Hatchbox, Caddy's configuration will update and attempt to validate the domain ownership. You can view the server's Caddy logs to check for errors.

Cloudflare

Create an API Token (not an API Key) withZone:Read and DNS:Write permissions.

DigitalOcean

Create an API token and add the domains permission.

DNSimple

Create an Account Token with Full access to Zones.

Gandi

Create a Personal Access Token with permission to "Manage domain name technical configurations"

GoDaddy

Create a Personal Access Token with domains.dns:update permission.

Add your API token to Hatchbox in the format of [GODADDY_API_KEY]:[GODADDY_API_SECRET]

Hetzner

Create an API token with Read & Write permissions.

Namecheap

Enable API access on your account and copy the API Key.

Route53

Use the following IAM policy and change to your hostedzone.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "route53:ListResourceRecordSets",
                "route53:GetChange",
                "route53:ChangeResourceRecordSets"
            ],
            "Resource": [
                "arn:aws:route53:::hostedzone/ZABCD1EFGHIL",
                "arn:aws:route53:::change/*"
            ]
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "route53:ListHostedZonesByName",
                "route53:ListHostedZones"
            ],
            "Resource": "*"
        }
    ]
}

Add your Access Key ID, Secret Access Key, and region.

Vultr

Enable API access on your account and copy the API Key.