🔐 Manual Wildcard SSL Certificate with Certbot (Let's Encrypt)

This guide walks you through manually obtaining a wildcard SSL certificate for *.nextrxai.com and nextrxai.com using Certbot with DNS-01 challenge validation.

---

📦 Prerequisites

Make sure you have the following before proceeding:

• ✅ Certbot installed on your machine → https://certbot.eff.org/instructions
• ✅ Access to your domain's DNS provider
• ✅ A terminal environment (Linux/macOS/WSL preferred)

---

🛠️ Command to Run

• • certbot certonly \\
    --manual \\
    --preferred-challenges dns \\
    --server <https://acme-v02.api.letsencrypt.org/directory> \\
    -d "*.nextrxai.com" \\
    -d "nextrxai.com"Copy

  Copy

---

📋 Step-by-Step Instructions

---

1. Run the Command

• Paste the above command into your terminal and hit Enter.

---

2. Follow Prompts

• Certbot will guide you through:
  • Email address input (for expiry notices)
  • Agreement to Let's Encrypt's Terms of Service
  • Optional subscription to EFF communications

---

3. Add DNS TXT Records

• Certbot will ask you to add TXT records for domain verification. For example:

  • Please deploy a DNS TXT record under the name:
    _acme-challenge.nextrxai.com
    with the following value:
    XXXXXXXXXXXXXXXCopy

• ➡️ Go to your DNS provider (Cloudflare, AWS Route 53, GoDaddy, etc.)
• ➡️ Add two TXT records: one for *.nextrxai.com , and one for nextrxai.com
• ➡️ Wait for DNS propagation — use a tool like https://dnschecker.org

---

4. Confirm and Continue

• Once the TXT records have propagated, return to your terminal and press ENTER.

---

5. Certificate Issued 🎉

• You should see a success message like this:

  • Congratulations! Your certificate and chain have been saved at:
    /etc/letsencrypt/live/nextrxai.com/fullchain.pem
    Copy

---

📁 Certificate Files Location

• ```fullchain.pem``` = Complete cert chain
• ```privkey.pem``` = Private key
• ```cert.pem``` = Your SSL certificate
• ```chain.pem``` = Intermediate cert

• Path: /etc/letsencrypt/live/nextrxai.com/

---

🔁 Renewal Notes

• This certificate is valid for 90 days.

---

🔔 Important:

• Manual certificates cannot be auto-renewed by Certbot. You must repeat this process before expiration.

---

✅ Tips & Best Practices

• ✅ Use DNS automation (e.g. Certbot DNS plugins) when possible.
• ✅ Set a calendar reminder to renew 2 weeks before expiry.
• ✅ Keep your private key safe and restricted.

🛠️ Nginx Configuration with Wildcard SSL

server {
server_name *.nextrxai.com nextrxai.com;

location / {
proxy_pass <http://localhost:3000>;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}

listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/nextrxai.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/nextrxai.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
listen 80;
server_name *.nextrxai.com nextrxai.com;

return 301 https://$host$request_uri;
}Copy