# Wildcard SSL Certificates with LetsEncrypt

LetsEncrypt supports wildcard SSL certificates but they must be verified using the DNS challenge

Wildcard SSL certificates are verified by LetsEncrypt using your DNS provider. It will look for a specific TXT record on your domain to prove ownership of the root domain (and therefore all the subdomains).

To do this, you'll need to provide an API key that can create, read, and delete DNS records on the domain.

After adding to Hatchbox, Caddy's configuration will update and attempt to validate the domain ownership. You can view the server's Caddy logs to check for errors.

### Cloudflare

Create an API Token (not an API Key) with`Zone:Read` and `DNS:Write` permissions.

![image.png](https://hatchbox.io/rails/active_storage/blobs/redirect/BAh7BkkiC19yYWlscwY6BkVUewdJIglkYXRhBjsAVGkClgRJIghwdXIGOwBUSSIMYmxvYl9pZAY7AEY=--df8d335afe83539f735db6156a67a5ac41ade544/image.png)
### DigitalOcean

[Create an API token](https://cloud.digitalocean.com/account/api/tokens/new) and add the domains permission.

![DigitalOcean API token permissions](https://hatchbox.io/rails/active_storage/blobs/redirect/BAh7BkkiC19yYWlscwY6BkVUewdJIglkYXRhBjsAVGkClARJIghwdXIGOwBUSSIMYmxvYl9pZAY7AEY=--2834ce070c4e2fbb11972e8c59dd9f0cf2c05771/Screenshot%202026-08-12%20at%208.51.20%E2%80%AFAM.png)
### DNSimple

[Create an Account Token](https://support.dnsimple.com/articles/api-access-token/#generating-an-account-access-token) with Full access to Zones.

### Gandi

[Create a Personal Access Token](https://docs.gandi.net/en/managing_an_organization/organizations/personal_access_token.html#create-a-token) with permission to "Manage domain name technical configurations"

### GoDaddy

[Create a Personal Access Token](https://developer.godaddy.com/personal-access-token) with `domains.dns:update` permission.

Add your API token to Hatchbox in the format of `[GODADDY_API_KEY]:[GODADDY_API_SECRET]`

### Hetzner

[Create an API token](https://docs.hetzner.cloud/reference/cloud#description/getting-started) with `Read & Write` permissions.

### Namecheap

Enable [API access](https://www.namecheap.com/support/api/intro/) on your account and copy the API Key.

### Route53

Use the following IAM policy and change to your `hostedzone`. 

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "route53:ListResourceRecordSets",
                "route53:GetChange",
                "route53:ChangeResourceRecordSets"
            ],
            "Resource": [
                "arn:aws:route53:::hostedzone/ZABCD1EFGHIL",
                "arn:aws:route53:::change/*"
            ]
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "route53:ListHostedZonesByName",
                "route53:ListHostedZones"
            ],
            "Resource": "*"
        }
    ]
}
```

Add your `Access Key ID`, `Secret Access Key`, and `region`.

### Vultr

Enable [API access](https://console.vultr.com/user/apiaccess/) on your account and copy the API Key.