One certificate to secure a domain and all its subdomains.
A wildcard SSL certificate is a type of SSL/TLS certificate that secures a domain and an unlimited number of its first-level subdomains using a single certificate. Instead of buying a separate certificate for each subdomain, one wildcard certificate covers them all.
It is identified by an asterisk (*) in the common name: for example, a certificate for *.example.com would automatically secure:
www.example.comapp.example.commail.example.comapi.example.comshop.example.comHowever, a wildcard certificate does not cover the root domain itself (example.com) or second-level subdomains like dev.api.example.com unless a separate SAN entry or certificate is added.
Check whether a site uses a wildcard certificate — look for *. in the Subject field.
When a browser connects to a subdomain secured by a wildcard certificate, it checks whether the certificate's Common Name (CN) or Subject Alternative Names (SANs) match the requested domain. For a wildcard certificate, the * matches any single label — meaning any direct subdomain.
The wildcard is validated during the TLS handshake: the server presents the certificate, the browser verifies it against the CA's root, and the connection is established encrypted if the domain matches.
A multi-domain certificate (also called a SAN certificate) explicitly lists every domain it covers — including different root domains (e.g. example.com, example.org, mysite.net). A wildcard certificate covers all subdomains of one root domain but cannot span multiple root domains.
For most websites with one domain and several subdomains, a wildcard certificate is the simplest and most cost-effective choice.
Since 2018, Let's Encrypt issues free wildcard certificates via the DNS-01 challenge. This requires you to add a TXT record to your domain's DNS during each renewal — a step that can be automated with compatible DNS providers.
To get a free wildcard certificate with Certbot:
certbot-dns-cloudflare)certbot certonly --dns-cloudflare -d "*.example.com" -d "example.com"Use the SSL Check tool above: enter any subdomain and look for *. in the Subject or SANs fields of the results. A wildcard certificate will show something like *.example.com as the common name.