Docs

Wildcard Certificate Renewal

Overview

Wildcard certificates (*.yourdomain.com) need one DNS record from you, once. After it is in place, every future renewal happens automatically, with no new records and no action needed.

How Wildcard Renewal Works

About 30 days before your wildcard certificate expires, we email you a CNAME record to add to your DNS. It looks like this:

Type Name Value
CNAME _acme-challenge.yourdomain.com <your code>.acme.expeditedssl.com

The process is:

  1. You receive the renewal email with your record (it is also shown on your dashboard’s TLS/SSL Certificate page)
  2. You add the CNAME record to your DNS
  3. We check for it daily; once it is found, the new certificate is issued and installed, usually within a day
  4. We email you when the new certificate is in place

Leave this record in place permanently. It is what lets us renew the certificate automatically from then on. If you remove it, the next renewal cannot complete.

Older Renewal Records

Before this process, each renewal asked for a different record with a long random name (for example _F5046DC145DBC06B4C733C7BD0AD001A.yourdomain.com). If a renewal email asks for one of those, add it as described in the email: that renewal finishes the older way, and the next one moves you to the one-time record. Once you have the _acme-challenge record in place, older renewal records can be deleted.

What Happens If the Certificate Expires

If the record is not in place before the expiration date, visitors to your site will see SSL certificate errors in their browser. To avoid this, please add the record as soon as you receive the renewal email.

Timeline

  • 30 days before expiry: We email the record to add (reminders follow daily until it is found)
  • Record found: We check daily; most certificates are issued and installed within a day
  • After that: Renewals are automatic

Troubleshooting

If your renewal is not completing:

  • Check the record with DNS is Beautiful: it should show your .acme.expeditedssl.com value
  • The record must be a CNAME, not a TXT record
  • If your DNS is on Cloudflare, set the record to “DNS Only” (gray cloud), not “Proxied”
  • Watch for a doubled name (_acme-challenge.yourdomain.com.yourdomain.com): many DNS providers add your domain for you, so enter just _acme-challenge in the name field
  • Ensure there are no CAA records blocking certificate issuance

Need Help?

If you are having trouble with a wildcard certificate renewal, please contact us right away: