Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use Certbot with the separately installed certbot-dns-cloudflare plugin. Let’s Encrypt wildcard certificates require the DNS-01 challenge; the plugin creates and removes the required _acme-challenge TXT records through Cloudflare’s API.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Create a Cloudflare API token restricted to the zone you need and grant it Zone:DNS:Edit. Store that token in a protected credentials file, request both the apex and wildcard names when necessary, and keep renewal on a machine that can access the file and the certificate.
As an Amazon Associate I earn from qualifying purchases.
What you are building
| Item | Purpose |
|---|---|
| Let’s Encrypt | Certificate authority issuing the TLS certificate. |
| DNS-01 challenge | Proves control of a domain by publishing a TXT value in DNS; it is the only Let’s Encrypt validation method that can issue wildcard certificates. |
| Cloudflare DNS | Hosts the authoritative DNS zone and stores the temporary TXT record. |
| Certbot | Requests, stores and renews the certificate. |
certbot-dns-cloudflare |
Certbot’s separate DNS plugin, which uses the Cloudflare API to create and clean up challenge records. |
The result is one certificate that can contain a wildcard name such as *.example.com. A wildcard covers one label immediately below the domain; it does not automatically cover the bare domain example.com or deeper names such as shop.eu.example.com.
Understand DNS-01 before you start
Why HTTP validation cannot issue this certificate
Let’s Encrypt validates ordinary certificates with several challenge types, but a wildcard identifier must use DNS-01. Certbot’s documentation states: “Doing domain validation in this way is the only way to obtain wildcard certificates from Let’s Encrypt.” During DNS-01, the authority gives Certbot a token. Certbot publishes a derived value as a TXT record below _acme-challenge, and Let’s Encrypt queries public DNS to verify it.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What the plugin automates
The Cloudflare plugin authenticates to the API, creates the TXT record, waits for the configured propagation interval, allows Let’s Encrypt to check the record, and removes the temporary record afterward. You do not need to edit a TXT record by hand for each issuance when the plugin can reach the correct authoritative zone.
Wildcard coverage is not apex coverage
Requesting only *.example.com leaves example.com uncovered. If users or services connect to both the apex and subdomains, request both names in the same certificate:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
-d example.com -d '*.example.com'The two identifiers are separate validation names. Cloudflare notes that a certificate covering the apex and wildcard requires two validation tokens in TXT-based domain control validation, even though the plugin handles both automatically.
Do not confuse certificate wildcards with wildcard DNS records
A TLS wildcard is a name in a certificate. A Cloudflare wildcard DNS record uses * in the record name to answer DNS queries that do not have a more specific record. An exact DNS record takes precedence over a wildcard DNS record. Changing a DNS wildcard record does not change the names in an already-issued certificate.
Check the DNS and deployment design
Confirm the authoritative zone
The domain names you request must be served by a Cloudflare DNS zone that the token can edit. Identify the zone containing the names before creating the token. For example, a certificate for *.example.com normally requires access to the example.com zone. If the name is delegated to another DNS provider, the Cloudflare plugin cannot publish the challenge there.
Choose where Certbot will run
Certbot does not have to run on the web server, but the renewal host must be able to reach Cloudflare’s API, read the credentials file and write the certificate files. A separate renewal host can work if you securely copy or distribute the renewed certificate to every reverse proxy, load balancer or game service that terminates TLS. Running Certbot on the machine that owns the live certificate usually reduces deployment steps.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteDecide the exact names
- Use
*.example.comfor one-level subdomains such asplay.example.comandstatus.example.com. - Add
example.comif the bare domain must work over HTTPS. - Add any other distinct names explicitly; a wildcard does not cover deeper levels or unrelated domains.
Create a least-privilege Cloudflare API token
Use a scoped API token rather than Cloudflare’s older global API key. The plugin documentation explains that a token can be restricted to specific domains and operations, while a global key can access the entire Cloudflare API account.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Open Cloudflare’s API token management area and choose the option to create a token.
- Restrict the token to the specific zone or zones that contain the names you will certify. Do not grant access to every zone unless the same renewal host genuinely needs all of them.
- Grant the DNS edit permission identified by the plugin documentation:
Zone:DNS:Edit. Do not add unrelated account, billing or zone-management permissions. - Create the token and copy its secret value immediately. Treat it as a password; a person who can read it, or cause Certbot to run with it, may be able to issue or revoke certificates for the associated domains.
If one certificate spans names in different Cloudflare zones, the token must be allowed to edit each required zone, or you must use an appropriate token arrangement for those zones. A token limited to the wrong zone will produce an authorization failure even when the DNS records look correct.
Install Certbot and the Cloudflare plugin
Install Certbot using the supported method for your operating system, then install the separate package named certbot-dns-cloudflare. DNS plugins are not included in a default Certbot installation. Verify that the installed Certbot lists the Cloudflare DNS authenticator before requesting a certificate.
Keep Certbot and the plugin on the same renewal host. If your operating system uses packaged applications, install both through its supported package channel; if it uses an isolated Python environment, install both into that same environment. Mixing a system Certbot with a plugin installed into an unrelated environment is a common cause of “plugin not found” errors.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Create and protect the credentials file
Create a directory readable only by the account that runs Certbot. A typical location is ~/.secrets/certbot/cloudflare.ini. Put the token in the file using the plugin’s documented key:
dns_cloudflare_api_token = YOUR_TOKENReplace YOUR_TOKEN with the real secret and do not commit this file to source control, place it in a web directory or paste it into logs. Restrict the file to owner-only access; on systems that support Unix permissions, that commonly means:
mkdir -p ~/.secrets/certbot
chmod 700 ~/.secrets ~/.secrets/certbot
chmod 600 ~/.secrets/certbot/cloudflare.iniCertbot warns when the credentials file can be read by other users. The plugin records the credentials-file path for future renewal but does not store the file contents in the renewal configuration. Protecting the file therefore remains your responsibility for the life of the certificate.
Request the wildcard certificate
Run Certbot with the Cloudflare authenticator and point it to the protected file. This command requests both the apex and wildcard names:
Recommended Free Tools
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini -d example.com -d '*.example.com'Use your real domain in place of example.com. The important options are:
certonlyobtains or renews the certificate without changing a web-server configuration.--dns-cloudflareselects the Cloudflare DNS-01 authenticator.--dns-cloudflare-credentialssupplies the path to the token file.- Each
-doption adds a certificate name. Include the apex separately if it is needed.
The plugin’s documented default propagation wait is 10 seconds. You can set a longer interval with --dns-cloudflare-propagation-seconds when your DNS environment needs more time:
certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini --dns-cloudflare-propagation-seconds 60 -d example.com -d '*.example.com'The interval is a wait chosen by the plugin, not a universal guarantee that every recursive resolver will see the TXT record in that time. If validation is intermittent, increase the interval and investigate delegation or caching rather than assuming issuance has a fixed latency.
What happens during issuance
- Certbot asks Let’s Encrypt for authorizations for every name in the request.
- The Cloudflare plugin uses the token to create the required
_acme-challengeTXT records in the target zone. - Certbot waits for the configured propagation period.
- Let’s Encrypt queries DNS and validates control of each requested name. The apex and wildcard identifiers can require separate TXT values.
- After validation, Let’s Encrypt issues the certificate and Certbot stores the certificate material on the renewal host.
- The plugin removes the temporary TXT records through the Cloudflare API.
Do not delete or overwrite challenge records while validation is in progress. If another automation system also manages _acme-challenge, coordinate it carefully so one process does not remove the other process’s value.
Install the certificate on your service
Inspect the paths reported by Certbot after a successful request and configure the TLS terminator—web server, reverse proxy, load balancer or other service—to use the certificate and private key. A certificate request alone does not enable HTTPS; the service must load the new files and listen with TLS.
- Keep the private key readable only by the account or service that needs it.
- Use the full certificate chain file supplied by Certbot where your TLS software requires an intermediate chain.
- Reload or restart the TLS terminator after issuance and after every renewal, according to that service’s documented procedure.
- If Certbot runs on a separate host, create a controlled deployment step that transfers the renewed files securely and then reloads each consumer.
Record which services consume the certificate. A successful renewal on the Certbot host does not update a proxy or server that still holds an older copy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Set up and verify renewal
Certbot stores renewal parameters, including the credentials-file path, so a scheduled Certbot renewal can repeat the DNS-01 process. Ensure the scheduled job runs as the same account, or as an account that can read the credentials file and write the certificate location.
Rank #4
- Reversible insert tool for can wrenches.
- One end for SLC Cabinets. Other end for pin in head screws found in most Network Interface boxes.
- Confirm that the scheduled environment has Certbot and the Cloudflare plugin installed.
- Confirm that the token remains valid and still has
Zone:DNS:Editaccess to every required zone. - Run Certbot’s renewal test workflow in your own environment, commonly with a dry-run option, and review the output rather than assuming the scheduler works.
- Verify that the post-renewal deployment hook reloads every TLS service that uses the certificate.
- After a real renewal, inspect the certificate dates on the service endpoint, not only the files on disk.
The credentials file must remain available for every future renewal. Removing it after the first successful issuance will cause the next automated DNS challenge to fail.
Troubleshoot common failures
“Plugin not found” or an unavailable authenticator
Certbot and the Cloudflare DNS plugin are separate installations. Install certbot-dns-cloudflare into the same environment that runs Certbot, then verify the plugin list again. A plugin installed for a different Python environment or system account will not be visible to the Certbot executable you invoked.
Cloudflare returns an authorization error
Check the token’s zone restriction and confirm it includes the zone that owns the challenge name. Confirm the permission is Zone:DNS:Edit, that the token has not expired or been revoked, and that the credentials file contains the token without extra quotation marks or accidental whitespace. A token with broad account access is not a fix for a wrong zone; correct the scope instead.
Certbot warns that the credentials file is insecure
Inspect the directory and file permissions, including parent directories. Remove group and world access and ensure the file is owned by the account that runs Certbot. Also check backups, shell history and configuration management, because a protected live file can still be exposed by an unprotected copy.
DNS validation times out
Check that the domain is actually authoritative on Cloudflare and that the token can edit that zone. Look for conflicting DNS delegation, split-horizon DNS or another automation process deleting the TXT value. Increase --dns-cloudflare-propagation-seconds when propagation is slow, but do not treat the documented 10-second default—or any larger setting—as a universal guarantee.
The wildcard succeeds but the root domain fails
The certificate request probably contains only *.example.com. Request example.com as a separate -d name. The apex and wildcard are distinct identifiers and may receive separate validation tokens.
A partial or CNAME setup does not validate
Cloudflare documents that partial or CNAME setups do not automatically receive SSL/TLS certificates for wildcard records and may require TXT-based or delegated domain-control validation. In that topology, identify which provider is authoritative for _acme-challenge and ensure your automation writes there. The Cloudflare plugin can only solve the challenge through the DNS API and zone that it can access.
The certificate is renewed but clients still see the old one
Check the service’s configured certificate path, file permissions and reload procedure. If renewal runs on a separate host, verify the transfer and deployment step. Inspect the certificate presented by the public endpoint to distinguish an issuance problem from a deployment problem.
Choose an implementation approach
| Decision axis | Cloudflare plugin | Manual or custom DNS hook |
|---|---|---|
| Automation | Creates and removes TXT records through the Cloudflare API during issuance and renewal. | Requires your own commands or scripts to publish, wait for and remove each TXT value. |
| Credential scope | Can use a zone-limited API token with Zone:DNS:Edit. |
Depends on the credentials and permissions implemented by your hook. |
| Execution location | Runs wherever Certbot and the plugin can reach the API and protected file. | Must run where the hook, DNS credentials and deployment process are available. |
| Hostname coverage | One request can include the apex and wildcard as separate names. | You must ensure the hook handles every requested authorization and token. |
| DNS topology | Best suited to zones managed authoritatively by Cloudflare; partial or CNAME arrangements need additional planning. | Can target another authoritative provider if you have a reliable hook for it. |
| Operational burden | Automatic record cleanup and renewal after initial setup. | More responsibility for propagation timing, cleanup, error handling and secret rotation. |
The plugin is the simpler choice when Cloudflare is authoritative for the zone and a narrowly scoped token is acceptable. A custom hook is appropriate only when your DNS architecture or security controls require a different provider or an existing secrets and deployment system.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Production checklist
- Cloudflare is authoritative for every zone containing a requested name, or you have deliberately designed delegated validation for the challenge name.
- The API token is restricted to the required zone or zones and has
Zone:DNS:Editonly as the needed DNS permission. - The token is stored in a credentials file with owner-only access.
- The Cloudflare plugin is installed in the same environment as Certbot.
- The request includes
example.comas well as*.example.comwhen the apex is required. - Propagation timing is configured conservatively for your DNS environment.
- The certificate and private key are deployed to every TLS-terminating service.
- Renewal has been exercised in your environment, and the post-renewal reload or deployment action is verified.
- Access to the token, private key and renewal host is monitored and limited to the accounts that need it.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
