Wildcard SSL: one certificate for every subdomain, and when you do not need it

The short answer: a wildcard certificate (with an asterisk) covers every subdomain one level down, such as shop.example.com and blog.example.com, without listing them one by one. You almost never need one: the ordinary free certificate covers the domain and the subdomains that exist, and each new subdomain gets its own.

What the asterisk covers, and what it does not

Address Covered by *.example.com?
shop.example.com Yes.
blog.example.com Yes.
a.shop.example.com (two levels) No. The asterisk only covers one level.
example.com (the bare domain) Not on its own. The certificate is usually requested for both: example.com and *.example.com.

When it makes sense

Your situation Do you need a wildcard?
You have the site, the blog and the shop on three subdomains you created by hand. No. Each has its own free certificate. See If the free certificate does not renew.
Your software creates a new subdomain for every customer (customer1.example.com, customer2.example.com...). Yes. You cannot request a certificate for every subdomain that is born.
You want one certificate to manage instead of several. You can, but you do not have to. Weigh the extra validation work, below.

The validation is different

To prove the domain is yours, the ordinary certificate leaves a file on the site. A wildcard cannot: the certificate authority requires you to create a TXT record in the domain’s DNS. This has two consequences.

1 The DNS must be editable by you or by a program. If the domain uses the registrar’s DNS or Cloudflare’s, that is where the record is created. See DNS records: A, CNAME, MX, TXT and TTL.
2 Renewal needs the TXT too. Creating it by hand at every renewal is not practical. On a VPS, certbot has plugins that create the record for you for several DNS services; see the certbot documentation for yours.
Mind the key: a wildcard serves any subdomain. If the private key leaks, whoever holds it can pose as all of them. Treat it like a password and do not copy it to machines that do not need it.
A paid certificate (DV, OV or EV) can also be a wildcard. Before buying, ask us whether your case justifies it: very often the free certificates are enough. To install a purchased one, see How to activate and install a paid SSL certificate.

Need a certificate for automatically created subdomains? Open a ticket saying how your software creates them.

Open a support ticket

SEE ALSO

The free SSL certificate did not renew: why AutoSSL fails and what to check

What is an SSL certificate and why does it matter?

Pointing a subdomain to another server or service: A record or CNAME

CAA records: who may issue certificates for your domain

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from KSh858.00/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Scanning your site for malware in cPanel: what Imunify finds and what to do with the result The short answer: cPanel has a tool called Imunify360, in the Security group, that scans your account’s files for malici...