What Is a Wildcard SSL? When to Use It and Obtaining It with DNS-01

If you have multiple subdomains, managing a separate certificate for each is troublesome. This is where the wildcard SSL certificate comes in: with a single certificate, it covers all subdomains of a domain. In this article, we explain what a wildcard SSL is, when it makes sense, and how to obtain it for free with DNS-01 verification.

What is a wildcard SSL?

A wildcard certificate is expressed by placing an asterisk (*) in front of the domain: *.yourdomain.com. This single certificate is valid for all of the following subdomains:

  • blog.yourdomain.com
  • panel.yourdomain.com
  • api.yourdomain.com
  • shop.yourdomain.com … and new ones you've never defined before.

An important limit: only one level

A single asterisk covers only one subdomain level. That is, a *.yourdomain.com certificate:

  • ✅ is valid for blog.yourdomain.com.
  • ❌ is invalid for shop.blog.yourdomain.com (two levels).
  • ❌ is not valid on its own for the root domain yourdomain.com.

For this reason, in practice you need to add both the root domain and the asterisk to the certificate together: yourdomain.com + *.yourdomain.com.

When should you use a wildcard?

  • If you have many subdomains: The management convenience is clear for 5–6 or more subdomains.
  • If you create dynamic subdomains: It's ideal for SaaS applications that give each customer a subdomain like customer1.yourdomain.com; every new subdomain is automatically covered.
  • If you frequently open new subdomains: A single wildcard is enough instead of issuing a new certificate each time.

On the other hand, if you only use yourdomain.com and www.yourdomain.com, you don't need a wildcard; a standard certificate that includes the two names is simpler.

Why is DNS-01 mandatory?

Wildcard certificates can only be obtained with DNS-01 (TXT record) verification. The HTTP-01 (file) method is not accepted for wildcards, because a single server file can't prove that you own "all subdomains." Being able to make changes in DNS, however, shows that you control the entire domain.

Image: <An _acme-challenge TXT record in the DNS panel>
For wildcard verification, a TXT record is added to the DNS panel.

How to get a wildcard SSL with DNS-01?

With our free SSL wizard, the steps are as follows:

  1. Enter *.yourdomain.com as the domain (if you also want to cover the root domain, use the relevant option in the wizard).
  2. Choose DNS (TXT) as the verification method; this is the only valid method for wildcards.
  3. Create the TXT record the wizard gives you in your DNS panel: 
    Type:    TXT
Name/Host: _acme-challenge.yourdomain.com
Value:   (the unique string generated by the wizard)
  4. Verify propagation and click "Complete Verification": 
    dig +short TXT _acme-challenge.yourdomain.com
  5. Once the certificate is generated, download the ZIP package: certificate.crt, private.key, ca_bundle.crt, fullchain.pem, and certificate.pfx.

Things to watch out for during installation

Installing a wildcard certificate is no different from a standard certificate: you define the same files with the same directives (fullchain.pem in Nginx, three separate files in Apache, certificate.pfx in IIS). The only difference is that the certificate is valid on many subdomains at the same time. You can serve all your subdomains from a single virtual host on the same server, or serve different servers by copying the same certificate to each.

Summary

A wildcard SSL covers all single-level subdomains of a domain with a single certificate and is obtained only with DNS-01 verification. It's ideal if you have many or dynamic subdomains. To generate your free wildcard certificate, use our free SSL wizard with the DNS (TXT) method.