Wildcard SSL certificates on IIS with Let’s Encrypt

Published 24 October 2026 · EverTLS

A wildcard certificate covers every site under a domain, but certificate authorities only issue them after DNS validation. Here’s how to get free wildcards onto IIS and keep them renewed.

Why wildcards are different

A wildcard certificate such as *.example.com covers every first-level name under a domain: www, shop, api and any you add later. It’s a natural fit for IIS servers that host many sites under one domain.

Certificate authorities only issue wildcards after DNS validation (the ACME DNS-01 challenge): you prove control of the domain by publishing a TXT record at _acme-challenge.example.com. The HTTP method, a file under /.well-known/acme-challenge/, isn’t accepted for wildcards. So the question on IIS isn’t the web server; it’s how the TXT record gets created on every renewal.

Two more details:

*.example.com doesn’t cover example.com itself. Put both names in the same certificate.
It covers one level only: a.b.example.com needs *.b.example.com.

Three ways to answer DNS validation

EverTLS offers three DNS methods. Pick per domain:

Method	What you do once	Does EverTLS hold a DNS key?
CNAME delegation	Add one CNAME: `_acme-challenge.example.com` → the unique target shown in the dashboard. Works with any DNS host.	No
Key on the agent	Save your DNS provider’s API key on your IIS server with the agent. The agent creates the records when asked.	No, only the key’s name
DNS provider API	Paste an API key for Cloudflare, Route 53, Azure DNS or one of 190+ providers into EverTLS, where it’s stored encrypted.	Yes

More detail on each, including how to limit what the key can do, is in wildcard certificates with DNS-01.

Step by step on IIS

Install the agent on the IIS server (Agents → Add agent, then run the command in PowerShell as Administrator).
Set up validation for the domain under Domains: CNAME delegation is the quickest. If you prefer the key on the agent, run this on the server and paste your provider’s key when asked:
```
& "C:\Program Files\EverTLS\evertls-agent.exe" dns add example-dns --provider cloudflare
```
then choose DNS · key on agent for the domain and pick that key.
Request the certificate with both example.com and *.example.com. Choose An agent generates it on my server so the private key never leaves the IIS server.
Install it on one or more IIS sites. The agent imports it into LocalMachine\My, switches each site’s HTTPS binding, and checks the sites serve it.

Several sites, one wildcard

When many IIS sites share one IP address and port 443, give each HTTPS binding its host name and tick Require Server Name Indication. All of them can use the same wildcard certificate, and the agent switches every one of them on renewal. For a load-balanced pool, deploy to an agent group, or write the certificate to an IIS Centralized Certificate Store as _.example.com.pfx.

Wildcard or one certificate per site?

A wildcard is simpler to manage, but its private key protects every name under the domain: if one server is compromised, all those names are exposed. Where sites are run by different teams or on servers with different trust levels, separate certificates per site are safer. EverTLS can create them in bulk with New certificate → Many at once.