A wildcard certificate secures every first-level subdomain of one domain. A multi-domain (SAN) certificate secures a fixed list of names, which may sit on several different domains. Choose by the shape of your inventory: many changing subdomains point to a wildcard, a short fixed list across several domains points to a SAN certificate.
What each one covers
- Wildcard (
*.example.com): matchesshop.example.comandapi.example.com, but nota.b.example.com. Check whether the bareexample.comis included. - Multi-domain / SAN: an explicit list such as
example.com,www.example.comandwww.other.com. Adding a name means reissuing the certificate. - Single name: one hostname, fine for a simple site.
Which fits which situation
| Situation | Lean toward |
|---|---|
| Many unknown future subdomains such as previews or tenants | Wildcard |
| A fixed short list across several domains | Multi-domain SAN |
Only the bare domain and www | Single name or a small SAN |
| Strict key separation per host | Separate certificates |
Trade-offs
Wildcard: one installation covers new subdomains without another request. One private key protects many hosts, so a leak reaches further, and it does not cover sibling domains.
SAN: an explicit inventory is easy to audit. Each new name needs a reissue, and the name cap of the product can force a second certificate.
Checklist before you buy
- List every hostname that must work on day one, including the bare domain.
- Estimate how many new subdomains you will add in the next twelve months.
- Note whether the names share one domain or span several.
- Decide who holds the private key and how it is rotated.
- Prefer automation for changing names; use a commercial certificate when procurement or organisation validation applies.
Compare options on the SSL certificates page. For the basics, read what an SSL certificate is, and for the free-versus-paid decision see Let’s Encrypt vs paid SSL. Certificates are used on web hosting and on your own servers.
Frequently asked questions
Does *.example.com cover example.com?
Not by itself. Confirm the product includes the bare domain or add it as a SAN, and test both names.
Can one SAN certificate secure two brands?
Yes, if both names are on the certificate and you can validate each. Some teams keep separate certificates to limit the impact of a key leak.
Is a wildcard better for SEO?
No. Search engines care that each public address works over HTTPS.
Wildcard or many free certificates?
If automation is in place, many individual certificates work well. A wildcard simplifies things when names change constantly.
