Wildcard Certificate

A wildcard certificate has a name beginning with an asterisk, such as *.example.com, and is valid for any single label in that position: www.example.com, app.example.com, mail.example.com.

Why it matters

If you run many subdomains, or create them dynamically for customers, a wildcard avoids issuing and renewing one certificate per name. The trade-off is blast radius: the private key protects every subdomain, so one compromised server affects all of them.

Example

*.example.com matches blog.example.com but does not match:

• example.com (the apex; list it as a separate name)
• a.b.example.com (two levels deep; the wildcard covers one label only)

With Let's Encrypt, wildcards can only be issued with the DNS-01 challenge, which means creating a TXT record at _acme-challenge.example.com:

certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com

For automation, use a DNS provider plugin rather than the manual flow.

Common mistakes

• Expecting the wildcard to cover the bare domain.
• Copying the same private key to many servers and teams without tracking where it lives.
• Using the manual DNS-01 flow, then failing to renew because nobody adds the TXT record in time.
• Trusting a wildcard to hide internal hostnames. Certificate Transparency logs record issued names, though a wildcard conceals the individual ones.

Related

• SAN certificate
• TXT record
• Certificate authority
• Guide: Let's Encrypt renewal failures
• Tool: SSL checker

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.