Skip to content
Register

Let's Encrypt wildcard on VPS—chicken and egg?

Web Hosting by liam_funky 5 replies 167 views
liam_funky

Member OP

Vancouver

#1

1. The problem
A) Need wildcard cert for *.example.com
B) VPS at Contabo, no zone editor
C) DNS-01 requires TXT record
D) Can't add TXT record without zone access

2. What I've tried
I) certbot manual — fails at propagation step
Ii) acme.sh — same issue, no API hook
Iii) Provider ticket — "not supported on legacy plans"

3. Current workaround
A) Using HTTP-01 for each subdomain
B) Painful with 12 subdomains
C) Hitting rate limits

4. What I need
A) ACME client that somehow bypasses this?
B) Or confirmation that I'm stuck

Anyone solved this on Hostinger-tier shared hosting? Or is this genuinely impossible without zone access or DNS API?

armstrongvds

Member

ARM Enjoyer

#2

Nag-install ako ng acme.sh before sa OVHcloud VPS, sobrang mabagal diba? Super slow propagation

Pero may trick: you use CNAME delegation to external DNS provider with API, so your main zone stay with OVHcloud but _acme-challenge point to Vultr DNS or something

Super effective, no need touch main zone

one small ping for man...
Izmir

Member

#3

Just use HTTP-01 my friend, wildcard not worth tought, I run 30+ sites on shared hosting very nice!!! Just make separate cert for each subdomain my friend, automation not needed for small setup!!!

Or you move to VPS my friend, full control, very nice!!! I pay $3/month for KVM at RackNerd, no tis problem!!!

kate3

Member

#4
Izmir said:
Move to VPS

OpenVZ containers share kernel with host. You're paying virtualization tax for fake isolation. Real KVM uses hardware extensions, proper cgroup limits, your own kernel modules.

For this specific problem: CNAME delegation is correct approach. No need to migrate entire stack to escape DNS limitation. The virtualization tax of moving to VPS exceeds benefit if sole purpose is certificate automation.

virsh list --all | wc -l: 47
brusselsdzire1

Member

#5
liam_funky said:
What I've tried I) certbot manual — fails at propagation step Ii) acme.sh — same issue, no API hook Iii) Provider ticket — "not supported...

Article 13 flashbacks. Providers withholding API access creates dependency lock-in, potentially violating GDPR Article 5(1)(a) on lawful processing—your domain data held hostage.

Request their data processing agreement. Under Article 20, porting DNS configuration to competing provider must not be artificially obstructed. Document this ticket response for complaint to national DPA if they refuse standard interoperability.

hankels

Member

52 VPS and counting

#6

I feel this pain

Contabo: €4 wildcard = impossible
Hetzner reseller: €4/month + free wildcard via cPanel
InterServer VPS: $2.50/month + full certbot

Math:
- Your 12 subdomains @ HTTP-01 labor:???
- My time: $15/hour minimum

Just CNAME delegate or migrate. Numbers don't lie.

seedbox, NAS, tape, and three offsite

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft