As a site grows, subdomains multiply: www, blog, shop, app, mail… Buying a separate certificate for each is both costly and hard to manage. This is exactly where a wildcard certificate comes in.
What Is a Wildcard SSL?
A wildcard SSL certificate is one whose common name is *.example.com. The asterisk (*) stands in for all first-level subdomains of that domain. So blog.example.com, shop.example.com, and app.example.com — any number of subdomains — are secured by one certificate. Most wildcards are issued to cover both example.com and *.example.com.
What It Covers and What It Doesn't
| Hostname | Covered? |
|---|---|
| blog.example.com | ✅ Yes (first level) |
| shop.example.com | ✅ Yes |
| example.com (apex) | ✅ Usually added to the SAN |
| a.blog.example.com | ❌ No (second level) |
| anotherdomain.com | ❌ No (different domain) |
*.example.com only secures direct subdomains. Nested addresses like a.b.example.com are out of scope; for those you'd need a separate wildcard or a multi-domain (UCC/SAN) certificate.When Should You Get a Wildcard?
- You have many subdomains — and don't want to manage a certificate for each.
- Dynamic subdomains — if you generate per-user addresses like
customer1.example.com. - Simpler management — one renewal, one installation, one private key.
Wildcard vs. Single-Domain vs. Multi-Domain: Which to Choose?
The three common certificate types answer different coverage questions. Use this to decide which fits your setup, then follow the link for the full multi-domain guide if needed.
| Criterion | Single-Domain | Wildcard SSL ★ | Multi-Domain (SAN/UCC) |
|---|---|---|---|
| What it secures | One specific hostname | One domain + all first-level subdomains (*.example.com) | A fixed list of specific names across any domains |
| Subdomains | None — buy separately per subdomain | Unlimited at one level | Only the names you explicitly list |
| Different root domains | ❌ | ❌ | ✅ |
| Best for | Small sites, single hostname | Many subdomains under one domain; SaaS, multi-tenant apps | Multiple unrelated domains; Exchange / comms servers |
| Relative cost | Lower | Medium | Medium — scales with SAN count |
Need the full breakdown on multi-domain? See our SAN/UCC multi-domain SSL guide.
One certificate, every subdomain — as long as they're one level deep.
Frequently Asked Questions
How many subdomains does a wildcard SSL cover?
Unlimited. A wildcard SSL certificate issued for *.example.com covers every first-level subdomain under that domain — blog.example.com, shop.example.com, app.example.com, and any others you add later, with no additional certificate required.
Does a wildcard SSL cover the apex domain (example.com)?
Usually yes. Most Certificate Authorities — including SSL.com — add the bare domain (example.com) to the certificate's Subject Alternative Names (SAN) alongside *.example.com. See the coverage table above for the exact hostnames covered.
Does a wildcard SSL cover second-level subdomains like a.blog.example.com?
No. *.example.com covers only one level of subdomains. An address like a.blog.example.com falls outside its scope. To cover it, you would need a separate wildcard for *.blog.example.com, or add it explicitly to a multi-domain (SAN) certificate.
Should I choose wildcard SSL or a multi-domain (SAN/UCC) certificate?
If you need to secure one domain and many of its subdomains, a wildcard SSL is usually simpler and more cost-effective. If you need to cover several unrelated domains (for example, example.com and anotherdomain.com), a multi-domain certificate is the better fit. See our SAN/UCC multi-domain SSL guide for a detailed comparison.
Can I get an EV wildcard SSL certificate?
No. Under CA/Browser Forum rules, EV (Extended Validation) wildcard certificates are not issued by any Certificate Authority. Wildcard certificates are available as DV (Domain Validation) or OV (Organization Validation). If you need EV-grade identity verification across multiple hostnames, consider a multi-domain EV certificate instead.