Wildcard and multi-domain (SAN) certificates both secure many names—but they solve different inventory shapes. Wildcard covers unlimited first-level subdomains under one base (*.example.com). Multi-domain lists explicit hostnames across one or several registrable domains. Choosing wrong wastes money or forces awkward reissues. This guide helps EuroVDC customers in Sofia (EU) match coverage to reality.
Compare options on SSL certificates; install on hosting or your own stack.
Coverage models in plain language
- Wildcard (*.example.com): Matches shop.example.com, api.example.com, anything.example.com—but not example.com itself unless the product also includes the apex, and not a.b.example.com (multi-level).
- Multi-domain / SAN: Explicit list: www.example.com, example.com, www.other.com, pay.brand.net. Each name must be known at issue time (or reissued when you add one).
- Single-name DV: One hostname. Fine for a simple site; irrelevant once you juggle many hosts.
Read the product sheet: some “wildcard” SKUs bundle apex; some SAN packs cap at 3/5/100 names.
Which fits which stack?
| Situation | Lean toward |
|---|---|
| Many unknown future subdomains (previews, tenants, regions) | Wildcard |
| Fixed short list spanning several root domains | Multi-domain SAN |
| Apex + www only | Single or small SAN—not wildcard |
| Strict key hygiene / least privilege per host | Separate certs or small SAN (shared wildcard key is broader blast radius) |
| Frequent brand microsites on new domains | SAN packs or per-domain LE automation |
Ops and security trade-offs
Wildcard pros: One install covers new subdomains without CA round-trips. Ideal for dynamic environments.
Wildcard cons: One private key protects many hosts—compromise is wider. DNS-01 challenges for LE wildcards need careful DNS ACL. Does not cover sibling domains.
SAN pros: Explicit inventory; easier audits (“these names only”). Can mix brands on one cert when truly needed.
SAN cons: Adding a name means reissue/redeploy. Hitting the name cap forces another product or split certs.
Decision checklist before you buy
- List every hostname that must work on day one (including apex).
- Estimate how often new subdomains appear in the next 12 months.
- Note whether names share one registrable domain or many.
- Decide who holds the private key and how you rotate it.
- Prefer automation (panel LE or ACME) for volatile names; commercial packs when procurement or OV/EV applies.
EuroVDC approach
Order the matching product on SSL certificates for Sofia hosting or servers. Use wildcard when subdomain churn is high under one domain; use multi-domain when you must nail a fixed cross-domain list. Keep web hosting renewals and HTTPS redirects boring—coverage choice does not replace mixed-content cleanup.
Frequently asked questions
Does *.example.com cover example.com?
Usually not by itself. Confirm the SKU includes the apex or add it as a SAN. Test both before go-live.
Can one SAN cert secure two different brands?
Yes if both names are on the certificate and you control validation for each. Some teams prefer separate certs for blast-radius and billing clarity.
Is wildcard better for SEO?
No. SEO cares that each public URL has working HTTPS. Coverage model is an ops choice.
Wildcard or many Let’s Encrypt certs?
If ACME is solid, many LE certs can beat a paid wildcard on cost. Choose wildcard when issuance friction or unknown future subdomains dominate.
What about nested subdomains (a.b.example.com)?
Standard *.example.com does not cover them. Use a deeper wildcard product if offered, or name them explicitly on a SAN.
How do I buy with EuroVDC?
Open SSL certificates, pick wildcard or multi-domain for your inventory, install on the terminating host and verify every name in a browser.
