Wildcard SSL certificates are essential for modern infrastructure — they secure entire ecosystems of subdomains, protect services, eliminate repetitive certificate management, and significantly reduce attack surfaces. Yet generating and managing wildcard certificates is still painful for many developers, sysadmins, and even DevOps engineers.
If you're running Marzban, Marzneshin, Nginx, proxy networks, API endpoints, or self-hosted services, you already know how complicated SSL can get: DNS-01 validations, TXT records, expiration, automation, mistakes in deployment, and the risk of downtime.
This article provides a complete, long-form, deep technical explanation of wildcard SSL, Cloudflare DNS security, automation workflows, and modern certificate management — and ultimately presents a tool that makes everything radically simpler: TawanaSSL-AutoWildcard.
🌐 Part 1 — Understanding Wildcard SSL Certificates
A Wildcard SSL Certificate secures:
-
A root domain:
domain.com -
Unlimited subdomains:
*.domain.com
This means you can secure:
-
api.domain.com -
panel.domain.com -
proxy.domain.com -
marzban.domain.com -
anything.domain.com
with one single SSL certificate.
🟢 Benefits of wildcard SSL
-
Reduced complexity: one certificate covers all services.
-
Better security posture: fewer misconfigurations.
-
Scalability: deploy new subdomains instantly.
-
Lower operational cost: less maintenance.
-
Cleaner automation workflows: ideal for proxies, API gateways, and control panels.
🔐 But there's a challenge…
Let's Encrypt requires DNS-01 verification for wildcard SSL.
This means:
-
You must add TXT records.
-
They must match exact tokens.
-
They must propagate globally.
-
They must be deleted afterward.
Doing this manually is prone to mistakes and often frustrating.
This is why Cloudflare DNS automation is crucial.
☁️ Part 2 — Cloudflare DNS: The Security Backbone
Cloudflare is more than a DNS provider. It's a modern security and performance layer for the internet.
With features like:
-
DNSSEC
-
DDoS protection
-
Anycast networks
-
1.1.1.1 recursive resolution
-
SSL acceleration
-
WAF
-
Reverse proxy caching
-
Zero Trust tunnels
…it has become one of the most trusted DNS platforms worldwide.
🧩 Why Cloudflare is perfect for SSL automation
Cloudflare API allows automated DNS management:
-
Add TXT records instantly
-
Remove them once verification is done
-
Zero manual steps
-
Near-instant propagation
This is exactly what wildcard SSL needs.
However, interacting with the Cloudflare API:
-
requires authentication
-
requires correct formatting
-
requires an ACME client like acme.sh
-
requires a secure environment to avoid leaking API keys
This is where automation becomes essential.
🔒 Part 3 — Security Implications of Automated SSL
Security isn't just about having HTTPS. It's about:
-
securing private keys
-
using stable certificate paths
-
ensuring services reload properly
-
avoiding overwritten certs
-
avoiding mismatched chains
-
ensuring zero downtime during renewals
Manual SSL workflows introduce security risks:
-
humans forget to renew
-
copy-paste mistakes
-
wrong permissions
-
wrong certificate paths
-
misconfigurations that expose internal services
Automation solves all of these.
But only if done carefully.
🟦 Part 4 — acme.sh: The ACME Client of Choice
acme.sh is one of the most reliable and flexible ACME clients for Let's Encrypt.
It supports:
-
DNS-01
-
ECC certificates (faster, lighter)
-
automatic renewals
-
custom hooks
-
multiple DNS providers
-
zero dependency mode
It’s fast, stable, and widely trusted.
However… it still requires automation glue for certain platforms like Marzban and Marzneshin.
🟢 Part 5 — The Real World Problem: Marzban, Proxies, and Certificates
Marzban and Marzneshin both rely on:
-
Nginx
-
Xray-core
-
TLS layers
If certificate paths break:
-
the panel goes offline
-
users lose access
-
inbound configs break
-
proxies fail
-
systems become insecure
SSL downtime is unacceptable.
This is why we need fully automated, safe, service-aware certificate deployment.
🚀 Part 6 — Introducing TawanaSSL-AutoWildcard
This script was created to make SSL automation dead simple for everyone.
Whether you're a:
-
professional sysadmin
-
DevOps engineer
-
proxy hoster
-
VPN provider
-
or a beginner managing personal servers
…this tool gives you a fully automated wildcard SSL solution.
🎯 What it does automatically:
-
Installs
acme.sh(if missing) -
Authenticates to Cloudflare
-
Issues wildcard SSL
-
Backs up existing certs safely
-
Installs new certificates
-
Reloads services (Nginx, Marzban, Marzneshin)
-
Ensures auto-renewal + auto-reload
Everything you need — in one tool.
🛠 Part 7 — Installation & Usage
📥 Download the script:
wget -O setup_ssl.sh https://raw.githubusercontent.com/tawanamohammadi/TawanaSSL-AutoWildcard/main/setup_ssl.sh
chmod +x setup_ssl.sh
./setup_ssl.sh
🧩 What happens next?
You will be asked for:
-
Cloudflare Email
-
Cloudflare Global API Key
-
Your domain
-
Whether you're using:
-
Marzban
-
Marzneshin
-
Custom directory
-
The script will:
-
issue SSL
-
install certs
-
reload services
-
confirm success
🟧 Part 8 — Cloudflare Security Best Practices
Cloudflare API keys are powerful.
Here’s how to protect your infrastructure:
✔ Use Global API Key only in trusted servers
✔ Rotate your API Keys periodically
✔ Do NOT hardcode the key in scripts
✔ Never share screenshots containing your key
✔ Keep Cloudflare 2FA enabled
✔ Keep DNSSEC activated
The script follows security guidelines:
-
It doesn’t store your API key permanently
-
It uses variables only in the running session
-
It never writes credentials to disk
🟦 Part 9 — ECC-256 vs RSA-2048: Why the Script Uses Modern Cryptography
ECC-256 certificates:
-
are faster
-
use less CPU
-
ideal for high load servers
-
recommended by Cloudflare
-
secure enough for modern standards
RSA-2048 certificates:
-
are heavier
-
require more CPU
-
slower handshakes
ECC is the future.
This script uses it by default.
🧩 Part 10 — Automatic Backups: Protecting Your Infrastructure
Before installing new certs, the script backs up:
-
fullchain.pem
-
key.pem
With timestamp:
fullchain.pem.bak-YYYY-MM-DD-HHMMSS
key.pem.bak-YYYY-MM-DD-HHMMSS
So even if something goes wrong, your old setup is one copy away.
🟢 Part 11 — Zero Downtime Reloading
The script automatically reloads:
-
nginx -
marzban -
marzneshin
Reloads are graceful, meaning no downtime.
📈 Part 12 — Monitoring & Verification Techniques
You can verify your SSL anytime:
Check main domain
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com | openssl x509 -noout -dates -issuer -subject
Check any subdomain
echo | openssl s_client -connect panel.yourdomain.com:443 -servername panel.yourdomain.com | openssl x509 -noout -dates -issuer -subject
🌍 Part 13 — Why Automation Elevates Security
Automation:
-
removes human error
-
ensures certificates never expire
-
enforces consistent paths
-
protects services
-
ensures reliability for users
Manual methods simply cannot compete.
🟣 Part 14 — My Other Work & Profiles (SEO-Safe Links)
To maintain safe SEO hygiene, links are placed once, not spammed.
🔗 Profiles & Platforms
-
Personal Website: https://tawana.online
-
GitHub: https://github.com/tawanam
🟦 Part 15 — Cloudflare Architecture & Why DNS‑01 is Superior
Wildcard SSL cannot be issued using HTTP‑01. Only DNS‑01 works — and Cloudflare makes DNS‑01 extremely fast, secure, and globally reliable.
🔐 Why Cloudflare DNS‑01 is the Best Option
-
🚀 Anycast DNS → instant global propagation
-
🔒 API‑based automation → zero manual TXT records
-
🛡️ DNSSEC support → prevents DNS spoofing
-
🌍 Global edge network → stability & speed
-
👨💻 Developer-friendly API → perfect for ACME clients
-
🧩 Seamless integration with acme.sh
In practice, this means:
-
No downtime
-
No propagation delays
-
No human error
-
Fully automated certificate lifecycle
🟧 Part 16 — Real‑World Scenarios Where TawanaSSL Helps
✔ Hosting Marzban / Marzneshin Panels
Certificate issues break:
-
admin panels
-
inbound configs
-
domain routing
-
TLS layers
-
subscription URLs
Wildcard SSL keeps everything stable.
✔ Large Proxy / V2Ray / XRay Deployments
If you manage:
-
dozens of subdomains
-
multiple servers
-
rotating infrastructures
Wildcard SSL = one certificate to rule them all.
✔ API Gateways & Microservices
Modern infrastructure often uses:
-
api.domain.com
-
auth.domain.com
-
db.domain.com
-
cdn.domain.com
Wildcard makes deployment vastly simpler.
✔ Personal & Business Websites
Even for a simple setup, wildcard SSL reduces future friction.
🟥 Part 17 — Security Considerations When Automating SSL
Automation increases security if implemented properly.
✔ Correct Permissions
Private keys must be readable only by necessary services.
✔ No Permanent Storage of API Keys
TawanaSSL does NOT store Cloudflare API keys on disk.
✔ Backup Before Overwriting
Every certificate update has timestamped backups.
✔ Graceful Service Reloads
No hard restarts → avoids downtime.
✔ ECC Certificates
Modern, lightweight, secure.
✔ Nginx Reload Safety
Nginx reloads do not drop connections.
🟦 Part 18 — Detailed Breakdown of What the Script Does
Here is the exact lifecycle:
1️⃣ Checks for acme.sh
If missing → installs it.
2️⃣ Sets Let’s Encrypt as default CA
Ensures production-level ACME directories.
3️⃣ Exports Cloudflare credentials (in‑memory only)
Secured & isolated to the running shell.
4️⃣ Issues SSL (ECC‑256)
For both:
-
domain
-
*.domain
5️⃣ Deletes TXT records afterward
Ensures a clean DNS environment.
6️⃣ Installs certificates to paths you choose
Safe updates for:
-
Marzban
-
Marzneshin
-
Custom servers
7️⃣ Backups old certs
Protects server continuity.
8️⃣ Reloads services
nginx → reload
marzban → restart
marzneshin → restart
9️⃣ Auto‑renew is activated
acme.sh installs cron automatically.
Everything is hands‑off afterward.
🟪 Part 19 — How Auto‑Renew Works Internally
acme.sh automatically:
-
checks certificate age
-
renews if < 30 days left
-
re‑runs the install-cert hook
-
triggers your reload commands
Meaning:
-
perpetual SSL
-
zero maintenance
-
fully stable uptime
🟩 Part 20 — Troubleshooting & Common Issues
Even with automation, here are important notes:
❗ Cloudflare proxy must be OFF for Marzban inbound usage
(Proxy mode orange cloud breaks TLS passthrough.)
❗ Your domain must be correctly pointed to server IP
A or AAAA records must exist.
❗ You must have permission to restart services
Script assumes root or sudo.
❗ Avoid using two ACME clients on same server
certbot + acme.sh can conflict.
🟫 Part 21 — Future Features Planned
-
Multi-server SSL distribution
-
Docker support
-
Support for Cloudflare API Tokens instead of Global Key
-
Integrations with Traefik & Caddy
-
Support for alternative DNS providers
-
Fully GUI-based web installer
🟦 Part 22 — Why I Built TawanaSSL (The Philosophy)
As someone who works deeply with:
-
infrastructure automation,
-
AI systems,
-
high-availability services,
-
and privacy-focused networks,
…I constantly saw how SSL mismanagement breaks systems.
I built this tool because:
-
automation = reliability
-
reliability = trust
-
trust = good infrastructure
This script is designed to empower everyone, from beginners to professionals.
🟧 Part 23 — Final Installation Guide (TL;DR)
wget -O setup_ssl.sh https://raw.githubusercontent.com/tawanamohammadi/TawanaSSL-AutoWildcard/main/setup_ssl.sh
chmod +x setup_ssl.sh
./setup_ssl.sh
Choose your panel → enter Cloudflare info → done.
🟪 Part 24 — Final Words
TawanaSSL-AutoWildcard exists to eliminate one of the most annoying problems in server management: insecure, expiring, or broken SSL.
Whether you’re running:
-
Marzban
-
Marzneshin
-
A custom proxy network
-
A microservices cluster
-
Or a personal website
…this tool gives you:
-
simplicity,
-
safety,
-
automation,
-
and long-term peace of mind.
If you found the project valuable:
👉 Give it a ⭐ on GitHub: https://github.com/tawanamohammadi/TawanaSSL-AutoWildcard
Happy Encrypting! 🔐🚀
.png)
