A wildcard certificate covers a domain and every subdomain one level below it, written as *.example.com. It is convenient when you create subdomains often, for example for a WordPress Multisite network, customer-specific subdomains or many test environments.
Before you start
- Check whether you really need one. AutoSSL already secures every subdomain you create in cPanel automatically, each with its own certificate, as long as DNS points to MdmHost.
- Wildcards are useful when subdomains are not created in cPanel individually, for example with a wildcard subdomain
*.example.comserving a multisite network. - You need access to DNS for the domain, because wildcard certificates can only be validated through DNS.
What a wildcard covers
| Hostname | Covered by *.example.com? |
|---|---|
shop.example.com | Yes |
www.example.com | Yes |
example.com (bare domain) | Only if also listed in the certificate; most CAs include it |
dev.shop.example.com | No, that is two levels deep |
example.net | No, a different domain |
Generate the CSR
- Open cPanel → Security → SSL/TLS → Certificate Signing Requests (CSR).
- Choose Generate a new key (RSA 2048-bit or ECDSA).
- In Domains enter
*.example.comand, on a new line,example.com. - Fill in city, state, country, company and email, then click Generate.
- Copy the CSR block and submit it to your certificate authority.
Complete DNS validation
- The CA gives you a TXT (or CNAME) record, often named
_acme-challengeor a random label. - Add it in cPanel → Domains → Zone Editor → Manage for the domain with Add Record. If your DNS is hosted elsewhere, add it at that provider.
- Wait a few minutes, then ask the CA to check. Remove the record after the certificate is issued.
Install the certificate
- Open cPanel → Security → SSL/TLS → Manage SSL sites.
- Paste the certificate into Certificate (CRT) and click Autofill by Certificate.
- Choose the domain the certificate should be installed on, check that the private key and CA bundle are filled, and click Install Certificate.
- Repeat the installation for each subdomain that has its own document root in cPanel, selecting it in the domain list, because each virtual host needs the certificate assigned.
Wildcard subdomains in cPanel
If you created a wildcard subdomain (*.example.com) in cPanel → Domains → Domains, install the certificate on that entry so every dynamic subdomain uses it. Add a DNS wildcard record * pointing to the server in the Zone Editor if it does not exist.
Free wildcard certificates
Let's Encrypt issues wildcard certificates only with DNS validation. Whether AutoSSL can issue wildcards for your account depends on the server's AutoSSL provider and on your DNS being hosted on the server. If you need a free wildcard and it is not issued automatically, ask our team at Support → New ticket what is possible for your plan.
Security considerations
- The same private key protects every subdomain. If one server using it is compromised, all subdomains are affected; reissue the certificate with a new key.
- Copy the key only to servers you control.
- Track the expiry date: paid wildcards must be renewed and reinstalled manually.
Troubleshooting
- Subdomain still shows another certificate: the certificate was not installed on that subdomain's virtual host.
- DNS validation fails: the record was added to the wrong zone; check which nameservers the domain uses with the WHOIS checker.
- Second-level subdomain shows an error: wildcards cover only one level; add a separate certificate.