One certificate can protect more than one hostname. A wildcard SSL certificate covers every subdomain at one level, while a SAN (multi-domain) certificate lists specific names, even on different domains. Choosing wildcard vs SAN depends on how many names you have and how they are spread across servers.
Before you start
- List every hostname that needs HTTPS, including
www, mail and panel subdomains. - Note which server each hostname lives on.
- Read DV vs OV vs EV if you are unsure about validation levels.
How a wildcard SSL certificate works
A wildcard certificate is issued for *.example.com. The asterisk matches exactly one label, so it covers shop.example.com and blog.example.com, but not dev.shop.example.com. Most CAs add the bare domain example.com as an extra name.
- Wildcards can be DV or OV, never EV.
- Free wildcards (Let's Encrypt) require DNS validation with a TXT record at
_acme-challenge. - New subdomains are covered immediately with no reissue.
How a SAN multi-domain certificate works
Every certificate has a Subject Alternative Name (SAN) extension listing the hostnames it is valid for. A multi-domain certificate simply lists many of them, for example example.com, www.example.com, example.net and client-site.org. Commercial CAs typically sell a set number of included names with paid extras, and Let's Encrypt allows up to 100 names per certificate.
cPanel AutoSSL already uses SAN certificates: one certificate per website covering the domain, www and service subdomains such as mail and webmail.
Wildcard vs SAN compared
| Wildcard | SAN / multi-domain | |
|---|---|---|
| Covers | Unlimited subdomains at one level | A fixed list of names on any domains |
| Different domains | No | Yes |
| Add a name | Automatic | Reissue the certificate |
| EV available | No | Yes |
| Name list | Subdomains not listed | All names visible in the certificate |
Security trade-offs
The main risk with wildcards is key sharing. If the same wildcard private key is installed on ten servers, a compromise of any one lets an attacker impersonate every subdomain. SAN certificates carry the same risk when one certificate serves unrelated sites, and they publish the full list of names, revealing relationships between sites. All public certificates also appear in Certificate Transparency logs.
Warning: Resellers should never put different clients' domains on one shared SAN certificate. Give each account its own certificate, which AutoSSL does automatically.
How to choose
- One site with www: a standard certificate already covers both. On MdmHost hosting AutoSSL handles this for free.
- Many dynamic subdomains (SaaS tenants, customer portals): use a wildcard.
- Several brands or domains on one server: use a SAN certificate, or separate free certificates per domain.
- Sub-subdomains: add each deeper wildcard (
*.shop.example.com) as an extra SAN on the same certificate.
Troubleshooting
- NET::ERR_CERT_COMMON_NAME_INVALID: the visited hostname is not in the SAN list or is two levels deep under a wildcard.
- Wildcard renewal fails: DNS validation cannot complete because the DNS is hosted elsewhere. Automate the TXT record through your DNS provider's API.
Frequently asked questions
Does a wildcard cover the root domain?
Only if the root is listed as an additional SAN. Most CAs and ACME clients add it on request.
Can a certificate be both wildcard and multi-domain?
Yes. A certificate can list *.example.com and *.example.net as SANs together.
Is a wildcard needed for email subdomains?
No. AutoSSL in cPanel includes mail. and similar service names in each domain's certificate.