Took me a bit of time to figure this out, so I thought I'd make it public. Letsencrypt announced their new wildcard certs, and because I have to add the SSL cert to a load balancer covering many subdomains, I needed to make use of it.
First thing to note is that not all clients support the new v2 API which is required for wildcard certs. I looked at the list of v2 supporting clients on the Letsencrypt site, and chose the acme.sh bash script. Not sure if I'm going to stick with it at this point but it got me going.
First thing you need to do is to run it with the –issue flag. You'll need to run it with DNS authentication, as that's the supported method for wildcard certs. You'll also need to run it with both the root domain AND the wildcard.