Wildcard SSL automation
Issue *.example.com certificates through DNS-01. The API refuses wildcard requests that try HTTP-01.
When to use a wildcard
Use a wildcard when you terminate TLS for many customer subdomains on one listener and do not want a certificate per hostname. Prefer per-hostname certificates when you need isolation or unique names in logs.
Validation
ACME requires DNS-01 for wildcards. The order response includes the TXT name and digest. Cloudflare can publish that record when a token is configured.
Coverage
A wildcard covers one label. *.example.com covers app.example.com, not a.b.example.com. Add extra SANs when you need both the apex and the wildcard.