We are building a site builder and users can set their own domain. Is there any way to enable SSL for their domains automatically?
For example, a wildcard letsencrypt certificate but not just for *.example.com but for * (any domain). So we no longer need to build a new certificate for each domain.
This is not possible. If it were possible, it would completely destroy the security assurance that certificates are supposed to provide.
If you try to connect to e.g. www.bankofamerica.com, you want to be sure you're actually talking to a Bank of America server, not passwordcollector.badguys.com. The SSL/TLS server certificate is what provides this assurance, by associating the domain name (www.bankofamerica.com) with a public key, and the TLS protocol uses the public key (& the corresponding private key that the server holds) to show that you're talking to the right server.
If you could get a global wildcard certificate, you could impersonate any website on the Internet -- banks, governments, gmail.com, anything. The bad guys would love to be able to do this, and the good guys have gone to a lot of trouble to make sure it's not possible.
Oh, and on a more technical note: a wildcard cert for * wouldn't actually do what you want, because the wildcard can only match a single level in the domain hierarchy. That is, if you have a certificate for *.example.com, it'll work for www.example.com and mail.example.com and whatever.example.com, but it won't work for www.subdomain.example.com because www.subdomain is two levels, and the wildcard only matches one. Similarly, if you did manage to get a cert for *, it'd work for com and net etc (which nobody actually use), but not example.com let alone www.example.com.
(Actually, you could also set up your own certificate authority, and issue whatever certificates you want from it. But nobody in the outside world is going to trust them, so it wouldn't accomplish anything useful.)
