One certificate for several domains and every first-level subdomain under them.

Sectigo Positive SSL Multi-Domain Wildcard is a domain-validated (DV) SSL/TLS certificate that secures several different domains and their first-level subdomains on one certificate. Each domain is added as a Subject Alternative Name (SAN), and any SAN can be a wildcard such as *.example.com. Agencies, SaaS teams and small businesses with a few brands on shared servers are the usual buyers.

With one domain, a plain wildcard costs less. With several domains and few subdomains, a standard multi-domain certificate is enough. This one makes sense when you have both.

The Short Answer

	Positive SSL Wildcard	Positive SSL Multi-Domain	Positive SSL Multi-Domain Wildcard
Validation	DV	DV	DV
Different domains	One	Several	Several
Subdomains per domain	All first-level	Only those listed	All first-level, per wildcard SAN
Typical fit	One brand, many subdomains	Several brands, few subdomains	Several brands, many subdomains
Company name in certificate	No	No	No

What A SAN Is, And What A Wildcard SAN Adds

Every certificate carries a list of the hostnames it’s valid for, in a field called Subject Alternative Name. The browser checks the address bar against that list and warns if the name is missing. A multi-domain certificate just has a longer list.

A wildcard SAN swaps the leftmost part of the name for an asterisk. A certificate covering two brands might look like this:

X509v3 Subject Alternative Name:
DNS:example.com, DNS:*.example.com,
DNS:example.net, DNS:*.example.net

That covers shop.example.com, mail.example.net and any other first-level subdomain on either domain. People regularly get caught by two details.

First, a wildcard only reaches one level down. *.example.com covers app.example.com but not eu.app.example.com. If you need the deeper name, add *.app.example.com as its own SAN.

Second, the bare domain is a separate name. *.example.com doesn’t cover example.com. List the apex yourself, or confirm the CA adds it for you. Then open the issued certificate and check.

What Sectigo’s Positive SSL Version Includes

Positive SSL is Sectigo’s DV product line. Domain validation proves you control each domain. It says nothing about who you are, so there’s no organization name in the certificate.

Reseller listings describe this edition as starting with a primary domain, one extra SAN and one wildcard SAN. You can add names up to 250 in total. Reissues are unlimited, and you’ll use that more than you expect, since every added or removed domain means a reissue. Sellers bundle and price SANs differently, so check what’s included before you order.

The encryption is identical to any other public certificate: RSA 2048-bit or ECDSA keys over modern TLS. People sometimes assume DV is “weaker” than OV or EV. It isn’t. What changes between them is how much the CA checks about your identity.

How Validation Works for Wildcard SANs

Each name has to pass domain control validation (DCV). Industry rules don’t allow the HTTP file-upload method for a wildcard name, so you’ll validate those by DNS or by email.

DNS is the method we’d pick. You add a CNAME or TXT record the CA gives you. Leave it in place and revalidation is effortless. Email works too, but only to fixed addresses like admin@ or webmaster@ on the domain, and someone has to click the approval link.

Non-wildcard SANs can still use file-based validation. Once everything passes, issuance usually takes a few minutes.

Plan For Shorter Certificate Lifetimes

A multi-year plan no longer gets you a multi-year certificate. Under CA/Browser Forum ballot SC-081, public TLS certificates have been capped at 200 days since March 2026. The cap falls to 100 days on March 15, 2027, and to 47 days on March 15, 2029.

You still get the subscription term you paid for, but you reissue inside it more often. With a dozen names on one certificate, every reissue lands on every server that shares it. Automate it with ACME if your seller supports that. If not, at least keep the DNS validation records in place so each renewal is quick.

When To Choose It, And When Not To

It’s a good fit if you run several brands or country domains with their own subdomains. It also suits client sites behind one server or load balancer, where one certificate is easier to deploy.

Skip it in a few cases.

If you have one domain, a single wildcard does the same job for less money.

If the domains belong to unrelated clients, think twice. Anyone can read every name in the certificate, so one shared certificate publishes your client list. Separate certificates keep clients apart and limit the damage if a key leaks.

If a buyer or bank wants verified identity, you need organization validation (OV). DV can’t give you that.

And if a free certificate will do, Let’s Encrypt issues wildcard and multi-name certificates and it’s a good service. With Positive SSL you’re paying for support, a warranty and reissue tooling from one vendor. You aren’t paying for stronger encryption.

Before You Buy Positive Ssl Multi-Domain

Write down every hostname you serve today, grouped by domain. Mark which domains need a wildcard and which only need the apex and www. Buy the package size from that count, not from a guess.

Then generate one certificate signing request (CSR) on the server that will hold the private key:

openssl req -new -newkey rsa:2048 -nodes \
  -keyout multi.key -out multi.csr \
  -subj “/CN=example.com”

The CSR only needs the primary name. You enter the other SANs while ordering.

FAQ