Chapter 9: Domain Names, DNS and Subdomains
9.11 HTTPS for your domain and subdomains
Once DNS resolves and port 443 is open, one certbot command secures all names (installation per OS is in section 7.13):
sudo certbot --nginx -d example.com -d www.example.com -d blog.example.com # or --apache
sudo certbot certificates # list certificates and expiry dates
sudo certbot renew --dry-run # test automatic renewal
Certbot verifies that you control each name by making an HTTP request to it, so every -d name must already resolve to this server. If one name fails, check dig name +short first. Wildcard certificates (*.example.com) need a DNS challenge (a TXT record) instead. Use them later, once you're comfortable.