diff --git a/bench/cli.py b/bench/cli.py
index e6ad9984..c314d90a 100755
--- a/bench/cli.py
+++ b/bench/cli.py
@@ -48,7 +48,7 @@ def check_uid():
 
 def cmd_requires_root():
 	if len(sys.argv) > 2 and sys.argv[2] in ('production', 'sudoers', 'lets-encrypt', 'fonts',
-		'print', 'firewall', 'ssh-port', 'role', 'fail2ban'):
+		'print', 'firewall', 'ssh-port', 'role', 'fail2ban', 'wildcard-ssl'):
 		return True
 	if len(sys.argv) >= 2 and sys.argv[1] in ('patch', 'renew-lets-encrypt', 'disable-production',
 		'install'):
diff --git a/bench/commands/setup.py b/bench/commands/setup.py
index 88b07bca..d3aec204 100755
--- a/bench/commands/setup.py
+++ b/bench/commands/setup.py
@@ -288,6 +288,7 @@ setup.add_command(reload_nginx)
 setup.add_command(setup_supervisor)
 setup.add_command(setup_redis)
 setup.add_command(setup_letsencrypt)
+setup.add_command(setup_wildcard_ssl)
 setup.add_command(setup_production)
 setup.add_command(setup_auto_update)
 setup.add_command(setup_backups)