Complete Guide to Wildcard SSL Certificates

Protecting multiple subdomains with a single certificate

If you run a website with multiple subdomains like blog.example.com, shop.example.com, and api.example.com, protecting all of them with HTTPS can be expensive and complex. The most cost-effective and simple solution is a Wildcard SSL Certificate. This guide explains what Wildcard SSL is, how it works, and how to choose the right certificate for your situation.

What is a Wildcard SSL Certificate and How Does It Differ from Single-Domain SSL?

A Wildcard SSL Certificate is designed to protect (encrypt) a primary domain and an unlimited number of subdomains under the same domain name, using a wildcard pattern represented by an asterisk *.

For example, a Wildcard SSL for *.example.com can protect:

• blog.example.com
• shop.example.com
• api.example.com
• mail.example.com
• And unlimited other subdomains

In contrast, a Single-Domain SSL protects only one domain, such as example.com. If you want to protect blog.example.com, you would need to purchase a separate certificate, which is more expensive and difficult to manage.

Key Difference: Single-Domain SSL = protects only 1 domain / Wildcard SSL = protects the primary domain + all subdomains with a single certificate

Understanding *.domain.com: What Subdomains Are Covered (and Which Are Not)?

This is where many people get confused. Wildcard SSL *.example.com covers only 1 subdomain level, not every possible level.

Protected Subdomains:

• blog.example.com ✓
• shop.example.com ✓
• www.example.com ✓
• mail.example.com ✓
• api.example.com ✓
• test123.example.com ✓

Not Protected:

• sub.blog.example.com ✗ (deeper than 1 level)
• deep.sub.blog.example.com ✗ (deeper than 1 level)
• example.com ✗ (primary domain - depends on configuration)

If you need to protect deeper subdomain levels like sub.blog.example.com, you would need to purchase an additional Wildcard SSL for *.blog.example.com or use a Multi-Domain SSL instead.

Important: *.example.com covers xxx.example.com only, not xxx.yyy.example.com or the primary domain example.com (configuration-dependent)

Wildcard SSL vs Multi-Domain SSL (SAN): Which Should You Choose?

Besides Wildcard SSL, another option is Multi-Domain SSL (Subject Alternative Name - SAN). This certificate allows you to specify multiple domains in a single certificate, but with a limited number, unlike Wildcard which has no limits.

Choose Wildcard SSL if: You have multiple subdomains of the same domain and want easy management.

Choose Multi-Domain SSL if: You have multiple different domains (example.com, myshop.com, myapi.net) but don't have many subdomains.

Free Let's Encrypt Wildcard Certificates via DNS Challenge

Let's Encrypt is the world's most trusted and free SSL certificate authority. Since 2016, Let's Encrypt has offered free Wildcard Certificates to the public with security equivalent to commercial CAs.

Basic Steps to Get Let's Encrypt Wildcard:

1. Use a tool like Certbot that supports ACME protocol
2. Configure to use DNS-01 Challenge (not HTTP-01)
3. Prove domain ownership to Let's Encrypt by adding a DNS TXT record
4. Receive a Wildcard certificate valid for 90 days

Critical: Let's Encrypt Wildcard requires DNS-01 Challenge only, not HTTP-01. You need a way to add DNS TXT records (via DNS management system or API)

Example Certbot command:

sudo certbot certonly --dns-cloudflare \
  -d example.com -d *.example.com \
  --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini

Certbot will automatically add the DNS TXT record (if you configured Cloudflare API key) and issue a free Wildcard certificate.

Let's Encrypt Wildcard Advantages:

• ✓ Completely free
• ✓ Trusted by over 1 million users
• ✓ Automatic renewal available
• ✓ Valid for 90 days at a time

Let's Encrypt Wildcard Limitations:

• ✗ Must renew every 90 days
• ✗ Requires DNS Challenge setup (more complex than HTTP)
• ✗ No EV (Extended Validation) - can't display "Verified Company Name" in browser

Purchasing Wildcard SSL from Commercial Certificate Authorities

If you need a legally binding Wildcard SSL with EV or 1-3 year validity, you can purchase from commercial CAs like Comodo, Sectigo, GlobalSign, or DigiCert.

Average Wildcard SSL Pricing:

• Wildcard DV (Domain Validation): $25-60/year
• Wildcard OV (Organization Validation): $45-120/year
• Wildcard EV (Extended Validation): $90-240+/year

Key differences:

• DV (Domain Validation): Only verifies domain ownership. Fast, convenient, affordable.
• OV (Organization Validation): Verifies company information. Moderate price, shows Organization Name in some browsers.
• EV (Extended Validation): Thorough verification of domain and company. Most expensive, displays "Verified Organization" and green bar in browsers.

For most users, DV Wildcard SSL is sufficient because the encryption security is identical across DV, OV, and EV. The difference is only in "company identity verification".

How to Install Wildcard SSL on Apache/Nginx/DirectAdmin

General Steps (Apache, Nginx, DirectAdmin):

Step 1: Obtain Certificate and Private Key Files

Whether from Let's Encrypt or a commercial CA, you'll get two files:

• certificate.crt (or .pem) - The certificate
• private.key - The private key

Step 2: Upload to Server

scp certificate.crt [email protected]:/etc/ssl/certs/
scp private.key [email protected]:/etc/ssl/private/

Step 3: Configure Apache

Edit your configuration file like /etc/apache2/sites-available/default-ssl.conf:

<VirtualHost *:443>
    ServerName example.com
    ServerAlias *.example.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/certificate.crt
    SSLCertificateKeyFile /etc/ssl/private/private.key
</VirtualHost>

Then restart Apache:

sudo systemctl restart apache2

Step 4: Configure Nginx

Edit your configuration file like /etc/nginx/sites-available/default:

server {
    listen 443 ssl;
    server_name example.com *.example.com;

    ssl_certificate /etc/ssl/certs/certificate.crt;
    ssl_certificate_key /etc/ssl/private/private.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
}

Then restart Nginx:

sudo systemctl restart nginx

Step 5: Configure DirectAdmin (Easiest)

If you're using DirectAdmin, simply:

1. Go to Admin Panel → Certificate Management
2. Select "Install Certificate"
3. Paste Certificate, Key, and CA Certificate
4. Specify Domain: *.example.com
5. Click "Install"

DirectAdmin will automatically configure Apache/Nginx settings.

Renewing Wildcard SSL Certificates

All SSL certificates have expiration dates. Most are valid for 1 year (commercial CAs) or 90 days (Let's Encrypt).

Renewing Let's Encrypt (Automatic):

Let's Encrypt has automatic renewal via cron job:

0 2 * * * /usr/bin/certbot renew --quiet

This command checks certificates daily at 2 AM and automatically renews any certificate expiring within 30 days.

Renewing Commercial CA Certificates:

1. Log into your CA's control panel
2. Find the certificate to renew
3. Select "Renew" and complete payment
4. Follow validation steps (usually email approval)
5. Download the new certificate
6. Install on your server (as in Step 6 above)

Tip: Set up a reminder 60 days before expiration to avoid forgetting renewal.

Wildcard SSL Security Considerations: What If the Private Key Is Compromised?

The main risk of Wildcard SSL is that if your Private Key is stolen or leaked, attackers can impersonate any subdomain under your domain.

Example: If you have a Wildcard SSL for *.bank.com and the Private Key leaks, attackers could:

• Create a fake paypal.bank.com that looks legitimate
• Steal user data from people visiting that fake site

Protection Methods:

• ✓ Restrict Private Key access to root and server administrators only
• ✓ Use file permissions: chmod 600 /etc/ssl/private/private.key
• ✓ Store the Private Key securely, don't share across multiple servers
• ✓ If a server is compromised, immediately revoke the certificate
• ✓ Use Hardware Security Module (HSM) for high-value servers
• ✓ Contact your CA about revocation and replacement certificate procedures

Important: Wildcard SSL has higher management risk than Single-Domain SSL because one certificate protects multiple domains.

Is Wildcard SSL Worth It Compared to Free Let's Encrypt?

Short Answer: If you can use Let's Encrypt, don't pay for anything. But there are cases where commercial Wildcard SSL makes sense.

When Let's Encrypt Wildcard is Perfect:

• Multiple subdomains needing free Wildcard protection
• Server can configure DNS API for challenge
• Accept 90-day renewal cycle
• Don't need EV (don't need "Verified Company" badge in browser)

When Commercial Wildcard SSL Is Better:

• Need EV (Extended Validation) for "Verified Company" display in browser
• Need OV certificate showing business verification in certificate
• Prefer renewing just once per year instead of 4 times per year
• Want warranty coverage (some commercial CAs offer this, Let's Encrypt doesn't)
• Server doesn't support ACME API renewal

Conclusion: For personal use, small to medium businesses, free Let's Encrypt Wildcard is the best choice. If you need professional validation and EV badges, commercial Wildcard SSL is worth the investment.