---
title: Blossom Wildcard Domains
url: "/docs/domains/wildcard-direct/"
canonical_url: https://docs.blossom88.com/docs/domains/wildcard-direct/
markdown_url: https://docs.blossom88.com/docs/domains/wildcard-direct.md
summary: Let Blossom issue and renew wildcard Domain certificates with a supported
  DNS provider
categories:
- domains
- networking
- ssl
- dns
- configuration
---

# Blossom Wildcard Domains

Wildcard Domains serve multiple subdomains such as `*.example.com` through one
Blossom Environment. Blossom handles TLS issuance and renewal through a
supported DNS provider.

> **Note**: If you're using a CDN like Cloudflare, CloudFront, or Akamai, you'll want to follow our [CDN Wildcard Domains](/docs/domains/wildcard-cdn/) guide instead, as the SSL termination happens at the CDN level.

## Overview

A wildcard domain certificate covers your main domain and all its subdomains. For example, a certificate for `*.example.com` will secure:

- test.example.com
- staging.example.com
- client1.example.com
- any-subdomain.example.com

## Requirements

To use wildcard domains, you need:

1. A DNS provider configured in Blossom that supports DNS validation
2. Administrative access to manage DNS records for your domain

## Supported DNS Providers

Blossom supports the following DNS providers for wildcard domains:

- Amazon Route 53
- Cloudflare
- DigitalOcean
- Hetzner

During certificate validation, Blossom briefly adds the required TXT record,
validates it, and removes it. The record may disappear before it is visible in
the DNS provider's dashboard.

## Configuration Steps

1. First, ensure you have a DNS provider configured in Blossom:

   - Navigate to DNS Providers section
   - Click "Add New Provider"
   - Select your provider and enter the required credentials

   Or use the CLI:

   ```sh
   blossom dns_provider:types
   blossom dns_provider:init
   ```

   It writes dns_provider.yml:

   ```yaml
   dns_provider:
     name: production-cloudflare
     provider_type: cloudflare
     credentials:
       api_token: ${CLOUDFLARE_API_TOKEN}

     # For Amazon Route 53, use an existing AWS cloud provider instead:
     # provider_type: route53
     # cloud_provider_id: cloud_provider-100
   ```

   ```sh
   blossom dns_provider:create --data dns_provider.yml
   blossom dns_provider:list
   ```

2. Configure your wildcard domain:

   - Go to your app's Domains section
   - Click "Add New Domain"
   - Enter your wildcard domain (e.g., `*.example.com`)
   - Select "HTTPS Wildcard" as the SSL mode
   - Choose your DNS provider from the dropdown

   Or create it with the CLI:

   ```sh
   blossom domain:create --data '{"domain":{"environment_id":"environment-100","dns_name":"*.example.com","dns_provider_id":"dns_provider-100"}}'
   ```

3. After creation, Blossom will:
   - Automatically configure DNS validation
   - Obtain a wildcard SSL certificate through Let's Encrypt
   - Keep the certificate renewed

## DNS Validation

Wildcard certificates require DNS validation (as opposed to HTTP validation) because they secure multiple subdomains. Blossom automatically handles this by:

1. Creating the required DNS validation records through your DNS provider
2. Verifying the records are properly set
3. Completing the certificate issuance process

## Important Notes

- Wildcard certificates only cover one level of subdomains. For example, `*.example.com` will cover `mysite.example.com` but not `test.mysite.example.com`
- The DNS provider must be properly configured with the necessary permissions for automated DNS validation
- Certificate renewal is handled automatically by Blossom

## Troubleshooting

If you encounter issues with wildcard domain setup:

1. Verify your DNS provider credentials are correct and have the necessary permissions
2. Check that your domain's nameservers are properly configured to use your selected DNS provider
3. Allow up to 15 minutes for DNS changes to propagate and the certificate to be issued
4. Inspect the Domain's TLS state and Activity for an actionable validation error

## Alternative Approaches

If you're using a CDN to handle SSL termination for your wildcard domains, see our guide on [CDN Wildcard Domains](/docs/domains/wildcard-cdn/).