how to apply for wildcard certificate http method

[xianfeiqiang]

I got example.com through http and it works,
But *.example.com doesn't work

*.example only support dns type ?

docker run --rm        -v $PWD/lego:/.lego        -v /usr/share/nginx/html/acme-challenge:/acme        goacme/lego        --accept-tos        --email="[email protected]"        --http        --http.webroot="/acme" -d *.example.com     run

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2023/03/14 10:27:27 [INFO] [*.example.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/210758200707
2023/03/14 10:27:27 [INFO] [*.example.com] acme: Could not find solver for: dns-01
2023/03/14 10:27:27 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/210758200707
2023/03/14 10:27:28 Could not obtain certificates:
	error: one or more domains had a problem:
[*.example.com] [*.example.com] acme: could not determine solvers

[ldez]

Hello,

you cannot, only the DNS-01 challenge is able to get a wildcard certificate.

It's not a lego limitation but a Let's Encrypt limitation.

[xianfeiqiang]

thank you for answer

[kolinfluence]

@ldez how to do wildcard letsencrypt then? i'm doing so, not sure how to enable wildcard letsencrypt for all subdomains

letsencryptCfg := &tls.Config{
	MinVersion:     tls.VersionTLS12,
	GetCertificate: certManager.GetCertificate,
	NextProtos: []string{
		"h2", "http/1.1", acme.ALPNProto,
	},
}

[ldez]

I think you are mixing several things: this question is about the HTTP01 challenge (how to obtain a wildcard certificate), not how to use a certificate on an HTTP connection.

As I said, with Let's Encrypt, to get a wildcard certificate, the DNS01 challenge must be used.
When you have obtained a wildcard certificate through the DNS01 challenge, you can use it as a normal certificate.

Your snippet is missing a lot of contexts, so the only thing that I can say is: the wildcard certificate must be provided by GetCertificate.