Setting Up Multi-Domain Virtual Hosts & Wildcard SSL Certificates with Nginx and Let's Encrypt

Setting Up Multi-Domain Virtual Hosts & Wildcard SSL Certificates with Nginx and Let's Encrypt

Author: Mir Alamin (Principal Web Architect) | Published: July 10, 2026 at 10:05 AM | Reading Time: 20 min read | Category: Architecture | Tags: Nginx, Web Server, SSL, Let's Encrypt, Architecture

---

Executive Summary

Managing dozens of client domains and subdomains on a single server requires well-structured Nginx virtual host configurations and automated SSL certificate management. Let's Encrypt provides free, automated TLS certificates. However, obtaining Wildcard SSL certificates (*.example.com) requires verifying domain ownership via DNS-01 challenge validation rather than standard HTTP-01 webroot checks.

This step-by-step tutorial covers configuring modular Nginx server blocks and automating Let's Encrypt Wildcard SSL renewals using Cloudflare DNS API automation.

---

1. Modular Nginx Directory Architecture

Keep virtual host configurations clean and maintainable by structuring /etc/nginx/:

/etc/nginx/
├── nginx.conf
├── conf.d/
│   ├── ssl_params.conf
│   └── gzip.conf
├── sites-available/
│   ├── clientA.com.conf
│   └── clientB.com.conf
└── sites-enabled/
    ├── clientA.com.conf -> /etc/nginx/sites-available/clientA.com.conf
    └── clientB.com.conf -> /etc/nginx/sites-available/clientB.com.conf

---

2. Automating Wildcard SSL Generation via Certbot DNS-01 Plugin

To issue a Wildcard certificate covering example.com and *.example.com:

# Install Certbot and Cloudflare DNS Plugin
sudo apt install -y certbot python3-certbot-dns-cloudflare

# Create Cloudflare API Credentials file
sudo mkdir -p /etc/letsencrypt/
sudo nano /etc/letsencrypt/cloudflare.ini

Add Cloudflare API Token to /etc/letsencrypt/cloudflare.ini:

dns_cloudflare_api_token = YourCloudflareApiTokenHere

Set strict file permissions:

sudo chmod 600 /etc/letsencrypt/cloudflare.ini

Execute Wildcard SSL Request:

sudo certbot certonly   --dns-cloudflare   --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini   -d example.com   -d "*.example.com"   --preferred-challenges dns-01

---

3. Complete Nginx Virtual Host Config with Wildcard SSL

# /etc/nginx/sites-available/example.com.conf

server {
    listen 80;
    server_name example.com *.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com *.example.com;

    root /var/www/example.com/public;
    index index.php index.html;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include conf.d/ssl_params.conf;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }
}

---

4. Cloudflare DNS & Web Server Services

For domain management, SSL certificate deployment, and Nginx administration:

• 🌐 Cloudflare Domain & DNS Setup Services
• ⚙️ Managed Server Administration Plans

---

5. Frequently Asked Questions (FAQ)

Q1: Why is DNS-01 challenge required for Wildcard SSL certificates?

HTTP-01 validation checks a specific URL file path on a single server, which cannot prove control over all potential subdomains. DNS-01 adds a TXT record to domain DNS settings, proving domain control globally.

Q2: How do I test Certbot automatic renewal?

Run sudo certbot renew --dry-run to verify that systemd timers successfully validate certificate renewals without manual intervention.

---

© 2026 WebCare Pro. Authored by Mir Alamin.