Wildcard certificate

A wildcard certificate is an SSL/TLS certificate whose Subject Alternative Name (SAN) contains a hostname with an asterisk as the left-most DNS label, allowing it to secure multiple first-level subdomains of a domain with one certificate and key pair.

The asterisk (*) matches any single label in that position only. For example, a certificate for *.example.com secures mail.example.com, www.example.com, and api.example.com, but does not cover the bare domain (example.com) or nested subdomains (a.b.example.com). Browser and TLS clients verify hostname matches against RFC 6125, which restricts wildcards to the left-most label only.

Example:

Subject Alternative Name: *.example.com
Covered:   mail.example.com ✓
Covered:   shop.example.com ✓
Not covered: example.com ✗
Not covered: dev.api.example.com ✗

Wildcard certificates reduce the operational burden of managing many subdomains — you buy one cert instead of separate certificates for each subdomain. They are typically Domain Validated (DV) only; Extended Validation (EV) cannot be issued as a wildcard under CA/Browser Forum rules.

Issuing Certificate Authorities must validate the base domain, and domain validation is performed at the apex domain level regardless of subdomain count.

WarningA single wildcard does not cover the bare domain or deeper subdomains. To secure both example.com and *.example.com, you must add the apex as a separate SAN entry in the certificate. For nested subdomains like api.example.com, you need either a separate wildcard (*.api.example.com) or explicit SAN entries.