One certificate covers every first-level subdomain you have and every one you add later. Here’s how to choose the right one and what to confirm before checkout.
If you’re about to buy a wildcard SSL certificate, the definition is short. A wildcard SSL certificate secures a domain and all of its first-level subdomains with one certificate and one private key. A certificate issued for *.example.com covers mail.example.com, shop.example.com, and any subdomain you add next month no reissue, no second purchase.
That’s the entire product. What differs between the options in front of you is how deeply the certificate authority (CA) verifies you, how many base domains are covered, and what happens when a server rebuild or an expiry catches you out, plus one validity rule that changed in March 2026 and reshaped how wildcard certificates are sold.
What a Wildcard Certificate Actually Covers
The one-level rule
So *.example.com covers blog.example.com and api.example.com but not api.staging.example.com that name sits two levels down and needs its own wildcard for *.staging.example.com.
If your subdomains are flat, one wildcard handles everything. If you’ve nested environments under staging or internal, count the levels first our wildcard vs single-domain comparison covers when a few named certificates are genuinely simpler.
Don’t assume the base domain is included
*.example.com is not a subdomain of itself, so it’s only protected if listed explicitly. Most CAs add it as an extra subject alternative name (SAN) at no cost:
Subject: CN = *.example.com X509v3 Subject Alternative Name:
DNS:*.example.com, DNS:example.com
If that second entry is missing, visitors to your apex domain get a name-mismatch warning. Confirm it before you pay.
DV or OV: which wildcard SSL certificate should you buy?
Validation level does not determine encryption strength. With equivalent keys and server configurations, DV and OV protect traffic with the same cryptography. The difference is what the certificate authority verifies and the service surrounding issuance.
| Option | What the CA checks | Typical issuance | Best fit |
| DV wildcard | Control of the domain | Often minutes after validation | Automated environments, SaaS platforms, public websites, and internal tools |
| OV wildcard | Domain control plus the organisation’s legal identity | Usually one to several business days | Organisations with procurement, audit, or identity-verification requirements |
| Multi-domain wildcard | DV or OV checks across several base domains | Follows the chosen validation level | Agencies, hosting providers, and businesses managing several domain families |
Encryption is identical across all three. A domain-validated (DV) wildcard protects traffic exactly as an organization-validated (OV) one does. What you gain by moving up is a vetted company identity inside the certificate, plus the warranty and support attached to it.
If you run several brands on separate domains, a multi-domain wildcard covers each base domain and its subdomains in one order, which is usually cheaper than buying a wildcard per brand.
What the cheapest wildcard SSL certificate really costs
Let’s Encrypt issues free wildcard certificates. They’re publicly trusted and, if you can automate DNS-01 validation, a legitimate answer. The catch is operational, not cryptographic: 90-day lifetimes, a DNS TXT record instead of a file on your web server, and when the automation breaks, you tend to find out when a customer does.
The honest case for paying is everything around the certificate: an OV option, a warranty, a human to email at 2 am, free reissues when you rebuild a server, and one dashboard showing what expires when. Nobody should buy a paid certificate because they were told the free one is weaker. It isn’t.
Where “cheapest” genuinely misleads is server count: some low-cost wildcards are licensed per server, so four load balancers can mean four licences. If speed matters more than identity, a DV wildcard issued in minutes is the budget option to compare against; check its licence terms alongside its price.
Why 2026 changed the wildcard renewal math
Since 15 March 2026, publicly trusted TLS certificates can’t be issued for more than 200 days, under CA/Browser Forum Ballot SC-081v3; most CAs issue at 199. The ceiling drops to 100 days in March 2027 and 47 days in March 2029, and domain validation reuse shrinks in step.
Multi-year wildcard products still exist, but as subscriptions rather than single certificates: you pay once for two or three years of coverage and reissue roughly twice a year inside it. So ask two questions: are reissues unlimited and free, and can domain validation be automated? A cheap wildcard needing manual email approval every six months costs more in your time than it saves on the invoice.
Six Checks Before You Buy
- Base domain: is example.com included as a SAN alongside the wildcard?
- Server licences: how many servers can you install it on?
- Reissues: free and unlimited for the life of the subscription?
- Validation methods: which are offered, and can DNS validation be scripted?
- Refund window: what happens if you order the wrong product?
- Key handling: one private key serves every subdomain it covers, so a leak from one low-value host exposes them all. Third-party-managed hosts are better off with their own single-name certificate.
Wildcard SSL myths worth clearing up
“A wildcard covers all my subdomains.” Only the first level; nested names need their own certificate.
“I want an EV wildcard.” They don’t exist. CA/Browser Forum extended validation (EV) guidelines require every name to be individually verified, which an open-ended wildcard can’t satisfy. If you need EV, list each hostname on a multi-domain certificate.
“Wildcards are less secure.” The certificate isn’t weaker. The shared private key concentrates risk, and that’s a deployment decision you control.
FAQs
Can one wildcard SSL certificate cover two different domains?
Not on its own. You need a multi-domain wildcard, which carries a wildcard entry for each base domain.
Do I need a new CSR for each server?
No. Generate one key pair and certificate signing request (CSR), then copy the certificate and key to each server.
How long does a wildcard certificate take to issue?
DV wildcards are usually issued minutes after the DNS or file check passes. OV takes longer because a person verifies your company records.
What happens to my subdomains when the certificate expires?
All of them break at once. That’s the trade for the convenience, and why renewal alerting matters more here than with a single-name certificate.
Final Thoughts
For most people, the decision is quick. Flat subdomains, no compliance pressure, speed matters most? A DV wildcard. Customers or auditors who inspect certificate details? Pay for OV. Several brands on separate domains? Multi-domain wildcard.
The two things that actually cost money later are the ones nobody checks at checkout: whether reissues are free, and whether validation can be automated now that certificates last under 200 days. Browse wildcard SSL certificates by validation level and warranty, or read why a wildcard suits growing sites if you’re still weighing it against single-name certificates.
