var client = new LetsEncryptClient(LetsEncryptClient.StagingV2);
await client.Init("your-email@example.com", CancellationToken.None);
var tos = client.GetTermsOfServiceUri(); // user should agree to this

// start a new order for the *.example.net wildcard domain
Dictionary<string,string> challenges = await client.NewOrder(new[]
{
    "*.example.net"
});

// do the DNS challenge
foreach(var challenge in challenges)
{
   await UpdateDnsServer(host: "_acme-challenge." + challenge.Key, token: challenge.Value, recordType: "TXT");
}

// Now that the DNS is updated, let Let's Encrypt know that it can validate them
await client.CompleteChallenges();

// get the certificate for the successful order
var cert = await client.GetCertificate();
//combine public cert with the private key for a full pfx
var pfx = cert.Cert.CopyWithPrivateKey(cert.PrivateKey);
File.WriteAllBytes("wildcard.example.net.pfx", pfx.Export(X509ContentType.Pfx));