What Is a Wildcard SSL Certificate and When Do You Need One?

A wildcard SSL certificate secures a domain and all of its subdomains with a single certificate — one certificate covers www.yourdomain.com, shop.yourdomain.com, blog.yourdomain.com and any others, all at once. It is written with an asterisk: *.yourdomain.com.

How it differs from a standard certificate

A standard certificate secures the specific names it is issued for — typically your domain and its www version. Every additional subdomain needs its own certificate. A wildcard covers them all in one, including subdomains you create later, with no extra issuance.

When a wildcard is worth it

• You run several subdomains — a store, a blog, an app, a help centre.
• You create subdomains often and do not want to issue a certificate each time.
• You offer subdomains to users in a multi-tenant setup.

When you probably don't need one

If you only run a single site with maybe a www version, a standard free certificate is perfect — see installing a free SSL certificate. Many sites never need a wildcard at all.

Free vs paid wildcards

Let's Encrypt can issue free wildcard certificates (validated via DNS), and paid wildcards are available too. To weigh the options, see SSL certificate types. If you would like a wildcard set up on your account, open a support ticket and we will help.

Frequently asked questions

Does a wildcard cover the root domain too?

A *.yourdomain.com wildcard covers the subdomains; certificates are usually issued to also include the bare yourdomain.com. When setting one up, include both so every version is secured.

Does it cover second-level subdomains?

A single-level wildcard covers anything.yourdomain.com but not a.b.yourdomain.com. Deeper levels need their own coverage. Most sites only use one level, so this rarely matters.

Is a wildcard less secure than individual certificates?

The encryption is the same. The main consideration is that one private key covers everything, so protect it well. For most site owners the convenience outweighs that, especially with automatic renewal.