What is a wildcard SSL certificate?
A wildcard looks like it covers everything under a domain. It covers exactly one level, and misreading that is the most common wildcard mistake.
A wildcard SSL certificate is a certificate issued for a name that begins with an asterisk, such as *.example.com, and it is valid for any single label in that position: www.example.com, shop.example.com and mail.example.com all match. It does not cover the bare domain example.com itself unless that name is added separately, and it does not cover two levels down, so a.b.example.com does not match. Wildcards are useful when a domain has many subdomains or creates them on demand; for a handful of known hosts, a certificate listing each name is simpler and safer.
Worked out 2026-10-16 (IST) · wildcard matching as defined in RFC 6125 and ACME issuance as defined in RFC 8555What a wildcard does and does not match
| Hostname | Covered? | Why |
|---|---|---|
| www.example.com | Yes | One label in the wildcard position |
| shop.example.com | Yes | One label in the wildcard position |
| example.com | No | The bare domain has no label to match the asterisk |
| a.b.example.com | No | Two labels; a wildcard matches only one |
| www.example.org | No | A different domain entirely |
| w*.example.com | Not issued | Public CAs issue the asterisk only as the entire leftmost label |
Wildcard or one certificate per name?
| Situation | Better choice |
|---|---|
| Three to five known subdomains | A multi-name certificate listing each one |
| Subdomains created on demand (one per customer or tenant) | A wildcard, which saves issuing a certificate each time |
| Some hosts are more sensitive than others (payments, admin) | Separate certificates, so a leak on one host does not expose the rest |
| Hosts run in different places, managed by different teams | Separate certificates, to avoid copying one private key around |
How issuance and validation work
A CA must see proof that you control the domain before it issues anything. For ordinary certificates this can be done over HTTP by placing a file on the web server. That cannot prove control of every possible subdomain, so wildcards require the DNS route: you publish a TXT record at _acme-challenge.example.com containing a token the CA gives you. Because that record is created through your DNS provider, a wildcard setup in effect depends on DNS API access, which is worth protecting as carefully as the certificate’s private key. If you restrict issuance with a CAA record, remember that wildcards are governed by the issuewild tag.
Lifetime and renewal
Wildcards follow the same maximum validity as any other public certificate, which is falling in steps under CA/Browser Forum ballot SC-081; see how long an SSL certificate is valid for the current limit and the schedule ahead. With lifetimes shrinking, automated renewal over the DNS challenge stops being a convenience and becomes the only practical way to run a wildcard. When a wildcard misbehaves in a browser, why an SSL certificate is not trusted lists the usual causes, starting with a missing apex name.
Sources: IETF RFC 6125 (verification of service identity in TLS), RFC 8555 (ACME), the CA/Browser Forum Baseline Requirements, and the Let’s Encrypt documentation, which introduced wildcard certificates in March 2018 and issues them only through DNS-01 validation.
Check your own numbers
Check which names a live certificate covers, including whether it is a wildcard.
Frequently asked
Does *.example.com cover example.com?
No. The asterisk must stand in for something, so the bare domain does not match. Almost every wildcard certificate in practice is issued with two names: *.example.com and example.com, so both are covered. When you request one, check that both names appear in the certificate’s Subject Alternative Name list.
Does a wildcard cover sub.sub.example.com?
No. The wildcard matches exactly one label. A host two levels down needs its own certificate, or a second wildcard such as *.sub.example.com.
Can I get a free wildcard certificate?
Yes. Let’s Encrypt has issued wildcard certificates since March 2018 at no charge, with one condition: they can only be validated with the DNS-01 challenge, meaning you prove control by publishing a specific TXT record in the domain’s DNS. That is usually automated with a DNS provider’s API.
Is a wildcard certificate less secure?
It has a larger blast radius. The same private key sits on every server that uses it, so a compromise of any one of them exposes the key for all subdomains, and a forged-looking host such as login.example.com becomes possible for anyone holding the key. Separate certificates per host contain the damage to one name.
Related answers
Need domain and DNS checks inside your own product?
We build WHOIS, RDAP, DNS and SSL lookups as embeddable widgets or a plain JSON API in your branding, wired to your own lead form. Tell us which checks you need and we will send a working demo.
Request received
Thanks — we will reply within one business day. Meanwhile, all 164 tools are free to use, no signup.