Application Load Balancer: wildcard hostnames

[scotwells]

You can now serve every subdomain of a domain you own from one Application Load Balancer. Add *.example.com as a hostname, and Datum issues and renews one certificate that covers app.example.com, api.example.com, and every other name one level below.

Note

Wildcard hostnames are an early-access capability that isn't turned on by default. Contact us to activate it for your project.

Add a wildcard hostname

Requires datumctl with the alb plugin v0.32.3 or later. To upgrade, run datumctl plugin upgrade alb.

datumctl alb hostname add my-app '*.example.com'
datumctl alb describe my-app

The describe output lists the DNS records to publish at your DNS provider, including the _acme-challenge record that lets Datum validate the certificate:

DNS records to publish:
  NAME                         TYPE   CONTENT                                       PURPOSE
  _acme-challenge.example.com  CNAME  <token>.acme-validation.datumdomains.net      Certificate

When the record resolves, the certificate is issued within a few minutes. The record doesn't change when the certificate renews, so you publish it once.

Things to know

• A wildcard covers one level. *.example.com matches app.example.com but not a.b.example.com.
• You verify domain ownership with a DNS TXT record. Verification reserves every name below the domain for your project.
• Exact hostnames are unchanged.
• If wildcards are later turned off for a project, existing wildcard certificates keep serving.

For the full walkthrough, see "Serve a wildcard hostname" in the ALB docs.