Wildcard certificates: what they cover and the common mistakes
A wildcard certificate protects a domain and all of its subdomains one level down with a single file. It is convenient, it is 15% of what we install — and it is also where people get things wrong most often, because "all of its subdomains" means something narrower than it sounds.
What it covers, and what it does not
A certificate for *.yourdomain.com:
| Domain | Covered? |
|---|---|
www.yourdomain.com |
Yes |
shop.yourdomain.com |
Yes |
api.yourdomain.com |
Yes |
yourdomain.com (nothing in front) |
Almost always, as an additional SAN |
app.staging.yourdomain.com |
No |
*.otherdomain.com |
No |
The asterisk covers one level, not every level. *.yourdomain.com does nothing for app.staging.yourdomain.com, because that is two levels down. For that you need a second wildcard for *.staging.yourdomain.com, or a multi-domain certificate.
On the bare domain: most authorities include yourdomain.com as an alternative name alongside the wildcard, but not all of them and not always. If your site answers on the domain without www, check with the SSL Checker rather than assuming it came along.
The three common mistakes
1. The CSR's common name needs the asterisk. When you generate the CSR, the Common Name field has to read *.yourdomain.com, asterisk included. Put www.yourdomain.com and the generation form will reject it, rightly: you asked for a wildcard and handed over a single-domain CSR. If it has already happened, run the CSR through our decoder to see what name it actually carries.
2. The CAA record needs issuewild. If your domain has a CAA record with the issue tag, that authorises ordinary certificates, not wildcards. Issuance is blocked even though validation is fine, and nothing tells you why. Add a second record with issuewild for the same authority.
3. One file, many servers. A wildcard can be installed on as many servers as you like — that is the point. But it means the same private key is now in several places: if one is compromised, you reissue for all of them. Worth deciding deliberately rather than out of convenience.
When it fits and when it does not
It fits when subdomains come and go — environments, customers, one site per project — and you do not want to issue a certificate every time.
It does not fit when there are a few stable, known subdomains. A multi-domain certificate is usually cheaper there, and spreads the private key less.
It does not work for several different domains. *.yourdomain.com does not cover yourotherdomain.com, however many subdomains they share. That is multi-domain, or two certificates.
When reissuing or renewing
All of the above applies again every time: the new CSR needs the asterisk too, and the CAA still needs issuewild. It is the most repeated mistake when reissuing — the CSR gets generated from memory, without the asterisk, and issuance fails.
