Wildcard SSL Certificate
A Wildcard SSL certificate protects your domain and all subdomains under it with one certificate. Instead of buying separate certificates for www, mail, shop and intranet, one Wildcard covers them all.
But wildcards have rules. This page explains exactly what * covers
and what to do when you need more.
How wildcard matching works
The asterisk * replaces
one arbitrary label, i.e. text without a dot. The asterisk cannot match a dot
(.), and it cannot
be empty.
*.fairssl.dk
Matches any name that has exactly one label before .fairssl.dk
* The root domain (fairssl.dk) is automatically included by the CA, but technically it is not the asterisk that matches it.
Example: One certificate with multiple wildcards
Imagine your certificate contains these three names:
These names are covered
- ✓ fairssl.dk , root domain
- ✓ www.fairssl.dk , matches *.fairssl.dk
- ✓ mail.fairssl.dk , matches *.fairssl.dk
- ✓ shop.fairssl.dk , matches *.fairssl.dk
- ✓ api.sub.fairssl.dk , matches *.sub.fairssl.dk
- ✓ staging.sub.fairssl.dk , matches *.sub.fairssl.dk
These names are NOT covered
- ✗ deep.api.sub.fairssl.dk , 2 levels below sub
- ✗ sub.fairssl.dk , *.fairssl.dk matches "sub", but sub.fairssl.dk is not the *.sub.fairssl.dk root
- ✗ other.example.com , entirely different domain
Have names that don't match a wildcard?
You can always add individual domain names as extra SAN fields in the certificate.
If you also need sub.fairssl.dk
or legacy.example.com,
simply add those names individually. Most wildcard certificates support multi-domain (SAN).
The rules in brief
The asterisk = one label
* matches one arbitrary label without a dot.
www, mail, api123, all are valid.
The dot = boundary
The asterisk cannot match a dot. That is why *.a.dk
does not cover x.y.a.dk, that is two levels.
Add more names
Missing a name? Add it individually as a SAN. You can mix wildcards and specific names in one certificate.
DV Wildcard vs. OV Wildcard
| DV Wildcard | OV Wildcard | |
|---|---|---|
| Price | From €161/year | From €402/year |
| Validation | Domain only | Organisation identity |
| Issuance | ~10-30 min | 1-3 days |
| Organisation name | ✗ | ✓ |
| Best for | Blogs, SaaS, dev | Businesses, e-commerce |
Validation: DNS is required
Wildcard certificates require DNS-01 validation: you need to add a TXT record to your domain's DNS. HTTP-01 validation is not supported for wildcards.
With FairSSL's AutoDNS you set a permanent CNAME record once, and we handle DNS validation automatically at every renewal, including via ACME.
Read about ACME automation with AutoDNS →Wildcard certificates
DV Wildcard
Thawte SSL123 Wildcard
DV wildcard from DigiCert. Can also add individual SAN names.
Sectigo PositiveSSL WC
Cheapest wildcard DV certificate.
OV Wildcard
DigiCert Basic OV Wildcard
OV wildcard from DigiCert. Organisation name in certificate.
GlobalSign OV SAN Wildcard
GlobalSign OV wildcard with SAN support.
GeoTrust True BusinessID Wildcard
GeoTrust OV wildcard. Strong trust at low price.
Frequently asked questions about Wildcard SSL
Find answers to the most common questions about SSL certificates and FairSSL.
Secure all your subdomains with one certificate
Create a free account and issue your first certificate in under 10 minutes.