Wildcard SSL: One Certificate for All Subdomains
Have app.domain.com + api.domain.com + mail.domain.com? Wildcard SSL covers all with one certificate. We explain when you need it and the cost.
Wildcard SSL Certificates: When You Need One and How to Install It
If your site runs on multiple subdomains — app.yourdomain.com, api.yourdomain.com, mail.yourdomain.com — purchasing a separate SSL certificate for each subdomain quickly becomes expensive and difficult to manage. A Wildcard SSL certificate is the solution.
What a Wildcard Certificate Covers
The asterisk * in *.yourdomain.com means "any first-level subdomain." This covers:
www.yourdomain.comapp.yourdomain.comapi.yourdomain.commail.yourdomain.comstaging.yourdomain.comdashboard.yourdomain.com
Install the certificate once, and all current and future subdomains are secured automatically.
What a Wildcard Certificate Does NOT Cover
The root domain: yourdomain.com (without www) is not covered automatically. You must request it explicitly, and most CAs include it when you specify it at ordering time.
Second-level subdomains: sub.api.yourdomain.com is not covered. Wildcard certificates only work one level deep.
Different domains: anotherdomain.com has no relationship to a Wildcard for yourdomain.com. For multiple distinct domains, you need a Multi-Domain (SAN) certificate.
When You Actually Need a Wildcard
Case 1: SaaS Platform or Multi-Tenant Application If each customer gets their own subdomain:
client1.yourplatform.comclient2.yourplatform.comclient3.yourplatform.com
Instead of issuing a certificate per client (which does not scale), one Wildcard covers all of them.
Case 2: Multiple Development Environments
dev.yourapp.comstaging.yourapp.comprod.yourapp.comapi.yourapp.com
One certificate, zero management overhead across environments.
Case 3: Multiple Services on the Same Domain
shop.yourcompany.com(store)blog.yourcompany.com(blog)crm.yourcompany.com(CRM)mail.yourcompany.com(email)
Financial Comparison
| Situation | Individual Certificates | Wildcard |
|---|---|---|
| 3 subdomains | 3 × $30 = $90/year | $120/year |
| 5 subdomains | 5 × $30 = $150/year | $120/year |
| 10+ subdomains | $300+/year | $120/year |
From 4 subdomains onward, Wildcard is cheaper. Beyond 8-10 subdomains, the savings are substantial.
Installing Wildcard SSL on cPanel
- Navigate to SSL/TLS in cPanel
- Select Manage SSL Sites
- In the Domain field, enter
*.yourdomain.com(with the asterisk) - Paste the certificate, private key, and CA bundle contents
- Click Install Certificate
Any new subdomain you create afterward is automatically secured without requiring a new certificate.
Installing Wildcard SSL on Nginx
server {
listen 443 ssl;
server_name *.yourdomain.com yourdomain.com;
ssl_certificate /etc/ssl/certs/wildcard.yourdomain.crt;
ssl_certificate_key /etc/ssl/private/wildcard.yourdomain.key;
ssl_trusted_certificate /etc/ssl/certs/ca-bundle.crt;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
}
Note server_name *.yourdomain.com yourdomain.com — this covers both the wildcard and the root domain.
Free Wildcard SSL via Let's Encrypt
Let's Encrypt issues free Wildcard certificates, but the verification requires a DNS challenge rather than the simpler HTTP file method:
certbot certonly --manual --preferred-challenges dns -d "*.yourdomain.com" -d "yourdomain.com"
Certbot asks you to add a TXT record to your DNS. After adding it and allowing propagation time, verification completes and the certificate issues.
The renewal challenge: DNS challenges complicate automated renewal. If your DNS provider offers an API, Certbot plugins can automate this. Without an API, manual renewal every 90 days becomes a recurring task. For many operations teams, this overhead makes annual paid Wildcard certificates worth the cost — install once, renew once per year.
Security Considerations
A Wildcard certificate means a single private key protects all your subdomains. If that key is compromised, every subdomain is at risk.
Best practices:
- Store the private key with restricted permissions:
chmod 600 wildcard.yourdomain.key - Never transmit the private key over email or messaging
- Maintain an encrypted backup separate from the server
- If you suspect compromise, revoke and reissue immediately
This security consideration is one reason some high-security environments prefer individual certificates per service — a compromise of one does not affect others.
The Bottom Line
A Wildcard certificate is the practical choice for any site operating across multiple subdomains. It saves money, reduces management overhead, and automatically covers new subdomains as your architecture grows. The limitations are real but narrow: no second-level subdomain coverage, no coverage for unrelated domains. Within those constraints, it is one of the most efficient infrastructure investments available.
Get Started
Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.
