Using multiple SSL certificates in a MultiSIte with Subdomains

This has nothing to do with WordPress. LetsEncrypt does not differentiate between the CMS used behind a domain. Your problem is rather that you have to set up a wildcard SSL for *.nigelsinger.com. In my experience, LetsEncrypt requires proof of the domain’s identity in the form of a TXT entry on the main domain. Your certificate setup tool should show you the details. Otherwise, I would recommend that you contact your hoster’s support team.

I have tried a wildcard, but LE cannot identify virtual subdomains, it can only use a wildcard with actual hosting subdomains and not WP virtual ones.

It sure can, with DNS challenge.

It may be your Plesk control panel limiting you to HTTP challenge, but LetsEncrypt surely supports this.

If WP only uses virtual subdomains, how can you get security coverage for them?

Either a wildcard certificate… or a SAN certificate (with the desired domains/subdomains in the SAN field). Either way, you’ll be linking to a single certificate file.

The advice goes against anything I have experienced with LE. The DNS set up works fine for the main domain using the acme-challenge domain and the record; fine for the main domain and for subdomains a wild card does not work, you have to go into each subdomain and apply a let’s encrypt seperately.

LE simply does not support wildcards to cover virtuals.

LE simply does not support wildcards to cover virtuals.

Did you even bother glancing over the official documentation I linked to?

DNS-01 challenge

This challenge asks you to prove that you control the DNS for your domain name by putting a specific value in a TXT record under that domain name. It is harder to configure than HTTP-01, but can work in scenarios that HTTP-01 can’t. It also allows you to issue wildcard certificates. After Let’s Encrypt gives your ACME client a token, your client will create a TXT record derived from that token and your account key, and put that record at _acme-challenge.<YOUR_DOMAIN>. Then Let’s Encrypt will query the DNS system for that record. If it finds a match, you can proceed to issue a certificate!

Emphasis mine.

Of course, you’re free to believe what you want.

Good luck!

See my last response to your other post on the same subject here: https://www.ads-software.com/support/topic/network-multisite-ssl-not-covering-virtual-sites/#post-18056667

Good luck!

I had a few minutes to spare before retiring to bed, and I was able to quickly whip together this demonstration which — according to you — should be impossible ??

Demo WordPress Multisite site: https://cftest.fun

The domain has a wildcard SSL certificate from Let’s Encrypt, which can be verified here: https://www.ssllabs.com/ssltest/analyze.html?d=cftest.fun

Here’s a multisite (virtual) subdomain demo, with a valid certificate:
https://multisite-dubdomain-demo.cftest.fun/

And to really test this, pull up any random subdomain you can think of: you should be taken to the Multisite signup page to register this non-existing subdomain site. But you’ll not see any certificate error/warning — because this Multisite installation has a valid Let’s Encrypt wildcard certificate covering any virtual subdomain you can think of. Here’s a random latest: https://hfdgashgfaayuegyudfuydgfhgfgewfsyur.cftest.fun

The advice goes against anything I have experienced with LE.

That’s hardly a valid reason to throw away other people’s experiences though ??