diff --git a/src/js/setupdns.js b/src/js/setupdns.js
index eca83737b..936ec8b14 100644
--- a/src/js/setupdns.js
+++ b/src/js/setupdns.js
@@ -35,6 +35,16 @@ app.controller('SetupDNSController', ['$scope', '$http', '$timeout', 'Client', f
             (tlsProvider === 'letsencrypt-prod' || tlsProvider === 'letsencrypt-staging'));
     };
 
+    $scope.setDefaultTlsProvider = function () {
+        var dnsProvider = $scope.domainConfigure.provider;
+        // wildcard LE won't work without automated DNS
+        if ((dnsProvider === 'manual' || dnsProvider === 'noop' || dnsProvider === 'wildcard')) {
+            $scope.domainConfigure.tlsProvider.provider = 'letsencrypt-prod';
+        } else {
+            $scope.domainConfigure.tlsProvider.provider = 'letsencrypt-prod-wildcard';
+        }
+    };
+
     // If we migrate the api origin we have to poll the new location
     if (search.admin_fqdn) Client.apiOrigin = 'https://' + search.admin_fqdn;
 
@@ -83,7 +93,7 @@ app.controller('SetupDNSController', ['$scope', '$http', '$timeout', 'Client', f
         provider: 'route53',
         zoneName: '',
         tlsConfig: {
-            provider: 'letsencrypt-prod'
+            provider: 'letsencrypt-prod-wildcard'
         },
         hyphenatedSubdomains: false
     };
diff --git a/src/setupdns.html b/src/setupdns.html
index 59938c743..2264e35ef 100644
--- a/src/setupdns.html
+++ b/src/setupdns.html
@@ -80,7 +80,7 @@
                                 <br/>
                                 <div class="form-group">
                                     <label class="control-label">Domain Provider</label>
-                                    <select class="form-control" ng-model="dnsCredentials.provider" ng-options="a.value as a.name for a in dnsProvider" ng-disabled="dnsCredentials.busy"></select>
+                                    <select class="form-control" ng-model="dnsCredentials.provider" ng-options="a.value as a.name for a in dnsProvider" ng-disabled="dnsCredentials.busy" ng-change="setDefaultTlsProvider()"></select>
                                 </div>
 
                                 <!-- Route53 -->
diff --git a/src/views/domains.html b/src/views/domains.html
index 7ce805de2..32588ddc4 100644
--- a/src/views/domains.html
+++ b/src/views/domains.html
@@ -17,7 +17,7 @@
 
             <div class="form-group">
               <label class="control-label">DNS API provider</label>
-              <select class="form-control" ng-model="domainConfigure.provider" ng-options="a.value as a.name for a in dnsProvider"></select>
+              <select class="form-control" ng-model="domainConfigure.provider" ng-options="a.value as a.name for a in dnsProvider" ng-change="domainConfigure.setDefaultTlsProvider()"></select>
             </div>
 
             <!-- Route53 -->
diff --git a/src/views/domains.js b/src/views/domains.js
index e44291822..b9ddfafc5 100644
--- a/src/views/domains.js
+++ b/src/views/domains.js
@@ -120,7 +120,7 @@ angular.module('Application').controller('DomainsController', ['$scope', '$locat
         hyphenatedSubdomains: false,
 
         tlsConfig: {
-            provider: 'letsencrypt-prod'
+            provider: 'letsencrypt-prod-wildcard'
         },
 
         fallbackCert: {
@@ -130,6 +130,16 @@ angular.module('Application').controller('DomainsController', ['$scope', '$locat
             keyFileName: ''
         },
 
+        setDefaultTlsProvider: function () {
+            var dnsProvider = $scope.domainConfigure.provider;
+            // wildcard LE won't work without automated DNS
+            if (dnsProvider === 'manual' || dnsProvider === 'noop' || dnsProvider === 'wildcard') {
+                $scope.domainConfigure.tlsConfig.provider = 'letsencrypt-prod';
+            } else {
+                $scope.domainConfigure.tlsConfig.provider = 'letsencrypt-prod-wildcard';
+            }
+        },
+
         show: function (domain) {
             $scope.domainConfigure.reset();