# What Is Wildcard Certificate (Wildcard SSL certificate)?

> Wildcard certificates are TLS certificates whose name begins with an asterisk label, such as *.example.com, matching any single-level subdomain.

Source: https://ssl.sh/glossary/wildcard-certificate/
Last updated: 2026-11-10

A wildcard certificate contains a name like `*.example.com` in its [Subject Alternative Name](https://ssl.sh/glossary/san/) extension. The asterisk may only be the entire leftmost label, and it matches exactly one label: `www.example.com` and `api.example.com` are covered, but `example.com` itself and `a.b.example.com` are not. Most wildcard certificates therefore list both `*.example.com` and `example.com`.

## Why it matters
Wildcards are convenient when you run many subdomains or create them dynamically, for example one per customer in a SaaS product, because one certificate covers them all without reissuing. The trade-off is that the same [private key](https://ssl.sh/glossary/private-key/) is usually copied to every server that uses the certificate, so a compromise on one host exposes all subdomains. To get a wildcard from an ACME CA such as Let's Encrypt (supported since March 2018), you must use the [DNS-01](https://ssl.sh/glossary/dns-01/) challenge; HTTP-01 cannot prove control of every possible subdomain. EV certificates cannot contain wildcards at all.

## Example
```bash
certbot certonly --manual --preferred-challenges dns \
  -d example.com -d "*.example.com"
```

Certbot asks you to publish a TXT record at `_acme-challenge.example.com`; in production, use a DNS provider plugin so renewals run unattended.

## Common misconceptions
- **`*.example.com` also covers `example.com`.** It does not; add the apex as a separate name.
- **A wildcard covers deeper levels.** `*.example.com` does not match `a.b.example.com`; you would need `*.b.example.com`.
- **One wildcard is always simpler and safer.** It is simpler to buy and deploy, but key sharing widens the blast radius; separate certificates or a [multi-domain certificate](https://ssl.sh/glossary/multi-domain-certificate/) per service limit the impact of a leak.

## Related terms

- [多域名证书](https://ssl.sh/zh/glossary/multi-domain-certificate/): 多域名证书是在 SAN 扩展中列出多个不同主机名、让一张证书同时保护多个域名的 TLS 证书。
- [SAN](https://ssl.sh/zh/glossary/san/): SAN 即主体备用名称，是 X.509 证书中列出其适用的所有域名、IP 地址等身份的扩展，客户端按它校验主机名。
- [DNS-01](https://ssl.sh/zh/glossary/dns-01/): DNS-01 是一种 ACME 验证方式，客户端在 _acme-challenge 子域名下发布由 CA 质询计算出的 TXT 记录来证明域名控制权。
- [Let's Encrypt](https://ssl.sh/zh/glossary/let-s-encrypt/): Let's Encrypt 是由非营利组织 ISRG 运营的免费、自动化证书颁发机构，通过 ACME 协议签发域名验证型 TLS 证书。
- [CN](https://ssl.sh/zh/glossary/common-name/): CN 即通用名称，是证书主体中曾用来填写域名的属性；现代浏览器已忽略它，只按 SAN 扩展匹配域名。
- [EV 证书](https://ssl.sh/zh/glossary/ev-certificate/): EV 证书是按照 CA/浏览器论坛《EV 指南》完成最严格身份审核后签发的 TLS 证书。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。