# Wildcard domains and certificates

You can configure your domains on Northflank to use wildcard redirect routing, which allows you to add subdomains without the need to add an individual DNS record for each new subdomain, and to use wildcard certificate generation, which allows you to add subdomains without requiring an individual certificate to be generated for each one, or to import and use your own certificate for your subdomains on Northflank.

You can use wildcard redirect routing in combination with wildcard certificate generation to allow the dynamic provisioning of subdomains in [templates](https://northflank.com/docs/v1/application/infrastructure-as-code/infrastructure-as-code) and [preview environments](https://northflank.com/docs/v1/application/release/set-up-a-preview-environment).

> [!note]
>
> [Click here](https://app.northflank.com/s/account/domains) to view your account domains page.

## Domain routing

Wildcard domain routing automatically verifies subdomains that you add to Northflank. You can enable it when you [add a domain to Northflank](add-a-domain-to-your-account).

> [!note]
>
> Wildcard routing restricts your domain to one region or BYOC cluster. You cannot use the top-level domain, also called the apex or root domain, for services. See [path-based routing](use-path-based-routing) for another way to route requests.

> [!warning] Choose the target before creation
>
> Choose the intended public or VPC load balancer before adding the domain. Wildcard routing and its target cannot change after creation. To change them, you must remove and recreate the domain. This interrupts existing routes and requires you to restore the domain and its subdomains.

To add a domain with wildcard routing:

1. On the Domains page, click Add domain.

2. Enter your domain name in Domain (FQDN).

3. In Domain routing, select Wildcard redirect.

4. If you use BYOC, select the cluster under Provider.

5. If you use Northflank Cloud, select the Region.

6. Select Public load balancer or VPC (private) load balancer under Load balancer.

7. Click Add domain grouping.

8. Create the supplied `CNAME` record in your DNS provider.

9. Return to Northflank to Verify the domain.

The CNAME record uses an asterisk subdomain, such as `*.wildcard` for `*.wildcard.example.com`, and the record content from Northflank. After verification, you can add subdomains in the selected region or cluster without adding more DNS records.

![Adding a wildcard domain in the Northflank application](https://assets.northflank.com/documentation/v1/application/domains/wildcard-domains-and-certificates/wildcard-domain-and-certificate.png)

### Public or VPC target

The Load balancer choices are Public load balancer and, where available, VPC (private) load balancer. The API field is `loadBalancer`, with the value `public` or `vpc`.

If you omit the target, Northflank selects public when the cluster enables it. Otherwise, it selects VPC. The selected path must be available on that cluster. See [Public and VPC ingress](https://northflank.com/docs/v1/application/bring-your-own-cloud/configure-your-cluster#public-and-vpc-ingress) for availability and requirements.

All child subdomains inherit the target, and each attached service port must support that exposure. Changing a child subdomain cannot override the parent target.

VPC-routed subdomains cannot use HTTP-01 certificate validation. Use [DCV, imported certificates, or supported wildcard certificates](./certificate-generation#certificates-for-vpc-ingress).

## Wildcard certificate generation

You can choose to enable wildcard certificate generation when adding a domain to Northflank which allows you to avoid hitting rate limits for [certificate generation](https://northflank.com/docs/v1/application/domains/domains-on-northflank#certificate-generation), as certificates are not generated for individual subdomains. Certificate generation must be configured when adding a domain to Northflank, and cannot be changed except by removing and re-adding the domain.

Wildcard certificates generate a certificate for the entire subdomain level. For example, enabling wildcard generation for `*.example.com` would provide the same certificate for any subdomains added to `example.com`, such as `a.example.com` and `b.example.com`.

You must configure wildcard certificate generation and domain redirect routing for a domain to dynamically generate subdomains in Northflank [templates](https://northflank.com/docs/v1/application/infrastructure-as-code/infrastructure-as-code) and [preview environments](https://northflank.com/docs/v1/application/release/set-up-preview-blueprints).

> [!note]
>
> Chromium-based browsers may return a 404 error if a user tries to access multiple subdomains that share the same certificate, at the same time, on a service.

### DCV

Domain Control Validation (DCV) allows you to use wildcard certificate generation by adding a CNAME record to your DNS provider.

To add a domain with a wildcard certificate through DCV:

1. On the Domains page, click Add domain.

2. Enter your domain name in Domain (FQDN).

3. In Certificate generation, select Wildcard via DCV.

4. Click Add domain grouping.

5. Create the supplied wildcard DCV CNAME record in your DNS provider.

6. Add the separate DNS record that Northflank requests to prove domain ownership.

7. Return to Northflank to Verify the domain.

After your DNS record has been verified any new subdomains you create under the domain will use the same wildcard certificate.

### Imported certificate

You can enable the use of wildcard certificates by importing a wildcard certificate from your DNS provider or certificate authority.

To add a domain with an imported wildcard certificate:

1. On the Domains page, click Add domain.

2. Enter your domain name in Domain (FQDN).

3. In Certificate generation, select Wildcard via Imported Certificate.

4. Paste the certificate chain into Certificate (Chain).

5. Paste its private key into Private key.

6. Click Add domain grouping.

7. Add the DNS record that Northflank requests to prove domain ownership.

8. Return to Northflank to Verify the domain.

Any new subdomains you create under the domain will use your own imported wildcard certificate, rather than a [Northflank-generated Let's Encrypt certificate](https://northflank.com/docs/v1/application/domains/domains-on-northflank#certificate-generation).

To replace an imported wildcard certificate, open the settings  for the domain. Expand Certificate Import. Paste the new certificate chain and private key into their fields. Click Update to use the new certificate.

![Importing a wildcard certificate in the Northflank application](https://assets.northflank.com/documentation/v1/application/domains/wildcard-domains-and-certificates/import-wildcard-certificate.png)

Wildcard certificates issued through DCV or imported into Northflank can serve VPC-routed subdomains. HTTP-01 cannot validate VPC-only ingress. See [certificates for VPC ingress](./certificate-generation#certificates-for-vpc-ingress) for supported methods and required DNS records.

## Redirect all subdomains

You can create a wildcard subdomain, which will accept requests to any subdomain and route them to the assigned port of a service.

To add a wildcard subdomain you must add your domain with [wildcard redirect](#domain-routing) and [wildcard certificate generation](#certificate-generation).

Once the domain has been verified, add a subdomain with `*` as the value and [assign it to a service's port](link-a-domain-to-a-port).

Requests to any subdomain at the level of the wildcard subdomain will now be forwarded to the assigned port.

For example, a wildcard subdomain added as `*.preview.example.com` for the domain `preview.example.com` will accept all requests to any subdomain `<string>.preview.example.com`, and route them to the specified service.

## Next steps

- [Add a domain: Add your domain name to your Northflank account.](/v1/application/domains/add-a-domain-to-your-account)
- [Link a domain to a port: How to link and unlink domains and subdomains with specific ports on your deployments.](/v1/application/domains/link-a-domain-to-a-port)
- [Add public ports: Configure ports to expose your services on the internet.](/v1/application/network/configure-ports#public-ports)
- [Domain registrar guides: Follow walkthroughs to add and verify domains on Cloudflare, NS1, OVH, and Namecheap.](/v1/application/domains/domains-on-northflank#custom-domains-and-subdomains)