Glossary / wildcard certificate

What is a wildcard certificate

A wildcard certificate is an SSL certificate that covers a main domain and all of its subdomains on one level at once. Instead of a separate certificate for shop, blog, and mail, you get a single one for *.example.com. It is handy when you have many subdomains or add new ones often.

The name field of such a certificate holds an asterisk: *.example.com. The asterisk stands in for any single subdomain name, so www.example.com, shop.example.com, and api.example.com all match one certificate.

There is an important limit: the asterisk covers only one level. *.example.com secures shop.example.com but not app.shop.example.com. Deeper levels need their own wildcard or a multi-domain certificate.

Wildcards are usually issued through DNS validation, where you add a special TXT record to the domain's zone. Free Let's Encrypt can issue wildcards too, but only via DNS validation.

One certificate for every subdomain is convenient, but it has a downside: if its private key leaks, every subdomain is exposed at once.

Example

*.example.com

Common mistakes

• Expecting *.example.com to also cover the bare example.com. The bare domain often has to be added to the same certificate separately.
• Thinking a wildcard covers all subdomain levels. It only works one level down.
• Reusing one wildcard key across many servers needlessly: a key leak compromises the whole domain.
• Paying for a wildcard when Let's Encrypt issues one for free via DNS.

Related terms

• SSL certificate What is an SSL certificate
• TLS What is TLS
• HTTPS What is HTTPS
• Let's Encrypt What is Let's Encrypt
• certificate chain What is a certificate chain