learn-to-earn

Posted on Oct 12

What Are Wildcard SSL Certificates (And Do You Actually Need One)?

#security #webdev #beginners #tutorial

You bought example.com. You want HTTPS on app.example.com, api.example.com, docs.example.com, and staging.example.com. That is four subdomains, and each one needs an SSL certificate.

You could get four separate certificates. Or you could get one wildcard certificate that covers all of them.

Here is what wildcard SSL certificates actually are, how they work, and whether you need one.

What a wildcard certificate covers

A wildcard certificate is issued for *.example.com. The asterisk matches any single-level subdomain:

app.example.com ✅
api.example.com ✅
staging.example.com ✅
anything-you-want.example.com ✅

It also covers the base domain example.com itself (most CAs include it as a Subject Alternative Name).

What it does not cover:

sub.app.example.com ❌ (nested subdomains need a separate wildcard: *.app.example.com)
example.org ❌ (different domain entirely)
other-domain.com ❌

The wildcard only goes one level deep. If you need nested subdomains, you need additional certificates or a multi-domain wildcard.

How to get a wildcard certificate

Let's Encrypt (free)

Let's Encrypt issues wildcard certificates, but only through the DNS-01 challenge. That means:

You request a certificate for *.example.com
Let's Encrypt asks you to create a specific TXT record in your DNS
Certbot (or another ACME client) verifies the TXT record
The certificate is issued for 90 days

The DNS-01 challenge requires either manual DNS updates or a DNS provider with API support. Certbot has plugins for Cloudflare, Route 53, Google Cloud DNS, and others that automate this.

# Example with Certbot and Cloudflare DNS plugin
certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d "*.example.com" \
  -d "example.com"

Pros: Free. Trusted by all browsers. Automated renewal if your DNS plugin supports it.

Cons: DNS-01 is more complex than HTTP-01. If your DNS provider lacks API support, renewal requires manual intervention every 90 days.

Commercial CAs (paid)

Certificate authorities like DigiCert, Sectigo, and GlobalSign sell wildcard certificates:

DV (Domain Validation) wildcard: $50–200/year
OV (Organization Validation) wildcard: $150–500/year
EV (Extended Validation): Does not support wildcards. EV certificates are issued per-FQDN only.

Paid wildcards are valid for 1 year (down from 2 years as of 2020) and include warranty coverage. The validation process is faster for DV (minutes) and slower for OV (days).

When to pay: If you need OV validation for compliance, if your organization requires a specific CA, or if you want a longer validity period than 90 days.

Cloudflare (included)

Cloudflare's free plan includes SSL for your domain and its subdomains. It handles wildcard coverage automatically for proxied records. You do not need to request a wildcard certificate separately — Cloudflare manages it as part of its Universal SSL.

For non-proxied (DNS-only) records, you can use Cloudflare's Origin CA to issue a wildcard certificate for your origin server.

When wildcard certificates make sense

You need one when:

You run many subdomains under a single domain (SaaS with tenant subdomains, microservices with service-specific subdomains)
You frequently create and remove subdomains and do not want to issue a new certificate each time
You want to simplify certificate management — one cert to renew instead of ten

You probably do not need one when:

You have one or two subdomains. Individual certificates (especially free ones from Let's Encrypt) are simpler.
Your hosting platform handles SSL automatically. Vercel, Netlify, Render, and Railway all provision certificates per-domain without you thinking about it.
You use a routing service that provisions certificates for you. Services like DomainDock handle automatic HTTPS for every subdomain without requiring you to manage certificates at all.

The management overhead

Wildcard certificates sound convenient, but they come with responsibilities:

Key compromise affects everything. If the private key for your wildcard cert is compromised, every subdomain is affected. You need to revoke the entire certificate and reissue it, which means downtime for all subdomains simultaneously.

Renewal failures cascade. If automated renewal breaks, every subdomain goes down — not just one. With individual certificates, a renewal failure affects only that specific service.

Not all platforms support them. Some CDNs and hosting providers cannot import wildcard certificates or have restrictions on where the private key is stored. Check compatibility before committing.

Monitoring is harder. With individual certificates, certificate monitoring tools can track each one separately. With a wildcard, you are monitoring one certificate that affects many services — and the expiration date is the same for all of them.

The simpler alternative

For most developers, the wildcard certificate question comes down to this: are you managing SSL at all?

If you deploy on a modern platform (Vercel, Netlify, Render, Railway), SSL is automatic. Each deployment gets its own certificate. You do not think about wildcards because you do not think about certificates.

If you need custom domains or subdomains with automatic SSL and no certificate management, DomainDock provides automatic HTTPS routing for any deployment URL. Each subdomain gets HTTPS automatically — no wildcard certificate, no DNS-01 challenge, no renewal scripts.

The best SSL certificate is the one you never have to manage.

Quick decision guide

Scenario	Recommendation
1-2 subdomains on a VPS	Individual Let's Encrypt certs
10+ subdomains, self-hosted	Wildcard via Let's Encrypt + DNS plugin
SaaS with tenant subdomains	Wildcard + automation, or managed SSL
Side project / portfolio	Platform SSL or DomainDock
Compliance requirement	Paid OV wildcard from a recognized CA

Pick the option that removes the most manual work. SSL should protect your users, not consume your weekends.

DomainDock provides automatic HTTPS for every subdomain — no certificates to manage, no DNS challenges, no renewal scripts. Free subdomains on digitalweb.host, or bring your own domain. Set up your custom domain in under 30 seconds.

Moonlight Devs builds DomainDock — domain routing and SSL for developers who ship fast.

DEV Community