Wildcards, multi-year and pricing
Cheapest wildcard SSL certificates (2026)
The cheapest wildcard certificate is free: Let's Encrypt and other ACME CAs issue *.example.com certificates if your DNS provider has an API for DNS-01. The cheapest paid wildcard we verified on 10 November 2026 was Sectigo EssentialSSL Wildcard at GoGetSSL for $84.00, then Namecheap Standard Wildcard SSL at $89.99 (renews at $99.89). For OV, Namecheap OV Wildcard SSL cost $185.99.
Cheapest DV wildcards (1-year price)
Sectigo EssentialSSL Wildcard at $84.00 was the cheapest paid DV wildcard. DV wildcards only check that you control the domain and are issued in minutes. Sorted by the lowest verified price:
| Certificate | Cheapest seller | 1-year price | Other sellers |
|---|---|---|---|
| Sectigo EssentialSSL Wildcard | GoGetSSL | $84.00 | The SSL Store $175.00 |
| Namecheap Standard Wildcard SSL | Namecheap | $89.99 | — |
| Sectigo PositiveSSL Wildcard | GoGetSSL | $128.00 | Trustico $152.00, The SSL Store $160.00 |
| RapidSSL Wildcard | GoGetSSL | $149.31 | The SSL Store $159.98 |
| Sectigo DV Wildcard | The SSL Store | $215.00 | Trustico $276.00 |
| GeoTrust QuickSSL Premium Wildcard | GoGetSSL | $279.98 | The SSL Store $299.98 |
| Thawte SSL123 Wildcard | GoGetSSL | $303.31 | — |
The same PositiveSSL Wildcard cost $128.00 at one seller and $160.00 at another, so always compare the identical product across sellers before comparing brands.
Cheapest OV wildcards
Namecheap OV Wildcard SSL at $185.99 was the cheapest OV wildcard. An OV wildcard adds your verified company name to the certificate, takes 1 to 3 business days and costs more:
- Namecheap OV Wildcard SSL: $185.99 first year, issued by SSL.com.
- SSL.com Wildcard SSL: $299.00, bought directly from the CA.
- GeoTrust True BusinessID Wildcard: $429.31 at GoGetSSL.
- Sectigo OV Wildcard: $535.00 at The SSL Store.
Should you pay for a wildcard at all?
Pay only if automation is impossible. A paid wildcard and a free ACME wildcard encrypt traffic identically and show the same padlock. Since 15 March 2026 any public TLS certificate lasts at most 200 days, so even a paid 1-year wildcard must be reissued and redeployed during the year, which is the manual work you hoped to avoid. If your DNS host (Cloudflare, Route 53, DNSPod, Alibaba Cloud DNS and many others) has an API, an ACME client such as certbot or acme.sh can renew a free wildcard on its own.
Buy a paid wildcard when your hosting panel cannot run ACME, when you need OV identity on every subdomain, or when a customer contract asks for a commercial CA.
Wildcard pitfalls
A wildcard has three limits to check before buying:
- One level only.
*.example.comcoversapi.example.combut notv2.api.example.com, as defined in RFC 9525. - Shared key, shared risk. Every server that uses the wildcard holds the same private key; if one is compromised, all subdomains are exposed until you revoke and reissue.
- No EV. EV certificates cannot be wildcards. Use a multi-domain certificate if you need EV on several names.
FAQ
What is the cheapest wildcard SSL certificate?
Free: a Let's Encrypt wildcard via DNS-01. Paid, for one year: Sectigo EssentialSSL Wildcard at GoGetSSL for $84.00 on 10 November 2026. On a 5-year subscription, Namecheap Standard Wildcard SSL works out at $39.99 per year.
Does a wildcard certificate cover the bare domain?
A wildcard name only matches subdomains, but most paid wildcard certificates also list the bare domain (example.com) as a second name. Check the product page; with ACME, request both example.com and *.example.com explicitly.
Can I get an EV wildcard certificate?
No. The CA/Browser Forum EV Guidelines do not allow wildcard names in EV certificates. Use an EV multi-domain certificate that lists each hostname instead.
Sources
This page contains affiliate links. We may earn a commission at no extra cost to you. Learn more