# Wildcard vs multi-domain SSL: which certificate do you need? > Wildcard certificates cover every first-level subdomain of one domain; multi-domain (SAN) certificates list exact names. Rules, prices, pitfalls. Source: https://ssl.sh/compare/wildcard-vs-multi-domain/ Last updated: 2026-11-10 Choose a **wildcard certificate** for many or changing subdomains of one domain: `*.example.com` covers `www`, `shop`, `api` and any other first-level name. Choose a multi-domain (SAN) certificate for a fixed list of names, names across different domains, or EV. For a handful of names, multi-domain is usually cheaper; for many subdomains, a wildcard is. Prices were copied from sellers' own pages on 10 November 2026. They change often, so the seller's checkout page is authoritative, and commissions never change our recommendations. ## The two shapes side by side | | Wildcard (`*.example.com`) | Multi-domain (SAN/UCC) | |---|---|---| | What it matches | Any first-level subdomain of one domain | Exactly the names listed | | Different registered domains | No | Yes | | Deeper levels (`a.b.example.com`) | No | Yes, if listed | | New subdomain later | Covered automatically | Reissue with the new name | | Validation levels | DV, OV | DV, OV, EV | | Names visible in CT logs | Only `*.example.com` | Every listed name | | Cheapest paid DV, 1 year | $84.00 | $35.99 (three domains) | | Free via ACME | Yes, DNS-01 only | Yes | ## How wildcard matching works A wildcard matches one level of subdomains only, not the bare domain and not deeper names. Its asterisk replaces the whole left-most label. Under [RFC 9525](https://www.rfc-editor.org/rfc/rfc9525), clients match it against exactly one label, so `*.example.com` matches `shop.example.com` but not `example.com` and not `v2.api.example.com`. If you need the second level too, you need a second wildcard name such as `*.api.example.com`. Paid wildcard products usually add the bare domain as an extra name; ACME clients let you request both `example.com` and `*.example.com` in one order. Let's Encrypt and other ACME CAs issue free wildcard certificates, but only through the DNS-01 challenge, so your DNS provider needs an API or you have to add TXT records by hand at each renewal. See [the acme.sh DNS API guide](https://ssl.sh/guides/acme-sh-dns-api-wildcard/). ## How multi-domain certificates work A multi-domain certificate puts each hostname into the Subject Alternative Name extension defined in [RFC 5280](https://www.rfc-editor.org/rfc/rfc5280). The names can belong to unrelated domains, and each one must pass domain control validation. Paid products include a fixed number of names and charge per extra name. Adding or removing a name means a reissue and redeploying the new certificate everywhere it is installed. EV certificates cannot be wildcards. Section 7.1.2.1 of the CA/Browser Forum EV Guidelines forbids wildcard domain names in the SAN extension, with an exception only for Onion names. So if you need EV on several hostnames, a multi-domain EV certificate is the only option; the cheapest we verified was Namecheap EV Multi-Domain SSL at $163.99 for three domains. ## Cheapest options in each shape The cheapest paid wildcard was $84.00 and the cheapest paid three-domain SAN certificate $35.99. **Wildcard (1-year prices):** - [Sectigo EssentialSSL Wildcard](https://ssl.sh/certificates/essentialssl-wildcard/) at [GoGetSSL](https://ssl.sh/go/gogetssl/): $84.00 (DV). - [Namecheap Standard Wildcard SSL](https://ssl.sh/certificates/namecheap-standard-wildcard-ssl/) at [Namecheap](https://ssl.sh/go/namecheap/): $89.99 first year (DV). - [Namecheap OV Wildcard SSL](https://ssl.sh/certificates/namecheap-ov-wildcard-ssl/): $185.99 first year (OV). **Multi-domain (1-year prices):** - [Namecheap SAN Certificate](https://ssl.sh/certificates/namecheap-san-certificate/): $35.99 with three domains (DV). - [Sectigo PositiveSSL Multi-Domain](https://ssl.sh/certificates/positivessl-multi-domain/) at [Trustico](https://ssl.sh/go/trustico/): $57.00, one primary plus two additional domains (DV). - [Namecheap OV Multi-Domain SSL](https://ssl.sh/certificates/namecheap-ov-multi-domain-ssl/): $79.99 with three domains (OV). - [Namecheap EV Multi-Domain SSL](https://ssl.sh/certificates/namecheap-ev-multi-domain-ssl/): $163.99 with three domains (EV). A quick way to compare cost: with three fixed names, the $35.99 SAN certificate is less than half the price of the cheapest wildcard. With ten subdomains of one domain, the SAN certificate needs seven extra names on top of its base price, while the $84.00 wildcard covers all ten and any you add later. The break-even point depends on each seller's per-name price, which is listed on the certificate pages. Full price tables are in [cheapest wildcard SSL](https://ssl.sh/compare/cheapest-wildcard-ssl/) and [cheapest multi-domain SSL](https://ssl.sh/compare/cheapest-multi-domain-ssl/). ## Which one fits your setup Match the certificate to how your names change: - **One site with `www` and the bare domain:** neither. A normal certificate with both names, free from any ACME CA, is enough. - **A SaaS or blog network creating subdomains on demand:** wildcard. New subdomains work immediately without reissuing. - **A few brand domains on one server or load balancer:** multi-domain. - **Subdomains at more than one level:** multi-domain, or a multi-domain certificate that combines several wildcard names. - **EV on more than one hostname:** multi-domain EV. - **Names managed by different teams or customers:** separate certificates, so one team's key or renewal problem does not affect the others. - **Internal-only hostnames:** every public certificate ends up in CT logs, so consider a [private CA](https://ssl.sh/cookbook/private-ca/) for names that should stay internal. ## Security and privacy trade-offs A wildcard key is usually copied to every server that serves a subdomain. If one of those servers is compromised, the attacker can impersonate any first-level subdomain until you revoke and reissue. A multi-domain certificate has the same shared-key problem for the names it lists, but the damage is limited to those names. Privacy cuts the other way. Chrome requires publicly trusted certificates to be logged in Certificate Transparency, so every name in a multi-domain certificate is public and searchable with a [CT search](https://ssl.sh/tools/ct-search/). A wildcard only reveals `*.example.com`, which hides the names of individual subdomains. ## Validity and renewals Both shapes follow the same lifetime limits. Since 15 March 2026 a publicly trusted TLS certificate is valid for at most 200 days; the limit drops to 100 days on 15 March 2027 and 47 days on 15 March 2029. A paid "multi-year" wildcard or SAN plan is a subscription that requires several reissues, and every reissue must reach every server that uses the certificate. The more servers share one certificate, the more valuable automation becomes; see [preparing for 47-day certificates](https://ssl.sh/guides/prepare-for-47-day-certificates/).