Certificates & Formats
What Is Wildcard Certificate?
A wildcard certificate covers all subdomains at one level of a domain: *.example.com matches app.example.com, mail.example.com and any other single-label subdomain. It is the convenience option when many subdomains need TLS — bought with a larger blast radius, because one private key now protects every one of those names.
The one-level rule
*.example.com matches exactly one label: it covers app.example.com but neither example.com itself (the bare domain must be added as a separate SAN) nor a.b.example.com (deeper levels need *.b.example.com). Most "wildcard doesn’t work" surprises are one of these two rules.
Wildcard versus SAN list
A multi-SAN certificate enumerates exact hostnames; a wildcard covers unknown future subdomains automatically. Wildcards win on operational simplicity, SAN lists win on containment — a leaked wildcard key impersonates every subdomain, and the same certificate copied to many servers multiplies the chance of that leak. Public CAs issue wildcards only with DNS-01 validation (proving DNS control), and some compliance regimes discourage them outright.
The modern middle ground is automation: with ACME issuing free per-host certificates in seconds, the convenience argument for wildcards is weaker than it was — reserve them for genuinely dynamic subdomain estates, and keep the key in one place.
Try it yourself — free tools
- Certificate Checker — see exactly which names a wildcard certificate covers
- CSR Generator — create a CSR with wildcard and bare-domain SANs correctly listed
How MI Support IT can help
PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.
PKI Glossary
- Subject Alternative Name (SAN)The certificate extension that lists every hostname, IP or email address a certificate is valid for.
- Certificate Lifecycle Management (CLM)The discipline — and tooling — that keeps hundreds of certificates issued, deployed, renewed and revoked without outages.
- Self-Signed CertificateA certificate signed by its own key — useful for labs and roots, dangerous as a habit in production.
- Browse all terms →