certificates
Wildcard SSL vs Multi-Domain SSL: Which Do You Need? (2026 Guide)
The choice between wildcard and multi-domain SSL comes down to what you're securing. A wildcard certificate covers one domain and all its direct subdomains. A multi-domain (SAN) certificate covers multiple completely different domains — they can even be at different registrars. Choosing the wrong type wastes money and requires re-issuance, so understanding the difference up front matters.
Free SSL Checker
Check which domains your certificate covers — SANs, wildcard, or both.
Try It Free →Technical Comparison
| Factor | Wildcard (*.domain.com) | Multi-Domain SAN |
|---|---|---|
| Subdomain coverage | All direct subdomains automatically | Only explicitly listed SANs |
| Different domains | No — one base domain only | Yes — up to 250 different domains |
| Adding new subdomains | No re-issuance needed | Re-issue certificate each time |
| Sub-subdomains (*.sub.domain.com) | Not covered by default wildcard | Can add explicitly or as separate wildcard SAN |
| EV validation available | No — wildcards not available as EV | Yes — EV SAN certificates are available |
| Let's Encrypt | Free (DNS-01 challenge required) | Free (up to 100 SANs, HTTP-01 OK) |
| Paid DV wildcard cost | $60–$300/year | $50–$500/year (varies by SAN count) |
| Security risk on compromise | All subdomains exposed | Only specific listed domains exposed |
| Best for | One domain, many subdomains | Multiple different domains |
Getting a Wildcard Certificate with Let's Encrypt
# Wildcard requires DNS-01 challenge — HTTP-01 doesn't work for wildcards
sudo certbot certonly --manual --preferred-challenges dns \
-d "yourdomain.com" \
-d "*.yourdomain.com"
# Certbot will prompt you to add DNS TXT records:
# _acme-challenge.yourdomain.com → VALUE1
# (Add this record, wait 1 min for propagation, then press Enter)
# Verify DNS propagation before pressing Enter:
dig TXT _acme-challenge.yourdomain.com +short
# For automated wildcard renewal, use a DNS plugin:
pip install certbot-dns-cloudflare # for Cloudflare DNS
sudo certbot certonly \
--dns-cloudflare \
--dns-cloudflare-credentials /etc/cloudflare/credentials.ini \
-d "yourdomain.com" \
-d "*.yourdomain.com"
Getting a Multi-Domain SAN Certificate
# Let's Encrypt SAN certificate (HTTP-01 challenge, up to 100 SANs):
sudo certbot --apache \
-d yourdomain.com \
-d www.yourdomain.com \
-d otherdomain.com \
-d api.yourdomain.com
# Or create a san.cnf config file for OpenSSL:
cat > san.cnf << 'EOF'
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[dn]
CN = yourdomain.com
[req_ext]
subjectAltName = @alt_names
[alt_names]
DNS.1 = yourdomain.com
DNS.2 = www.yourdomain.com
DNS.3 = otherdomain.com
DNS.4 = api.yourdomain.com
EOF
openssl req -new -newkey rsa:2048 -nodes \
-keyout multi.key -out multi.csr -config san.cnf
# Verify SANs in the CSR:
openssl req -in multi.csr -noout -text | grep -A5 "Subject Alternative Name"
Installing a Wildcard or SAN Certificate in Apache/Nginx
# Apache — single certificate file covers all domains/subdomains:
<VirtualHost *:443>
ServerName yourdomain.com
ServerAlias www.yourdomain.com api.yourdomain.com
SSLCertificateFile /etc/ssl/certs/wildcard-or-san.crt
SSLCertificateKeyFile /etc/ssl/private/wildcard-or-san.key
</VirtualHost>
# For multi-domain SAN covering different root domains:
<VirtualHost *:443>
ServerName yourdomain.com
ServerAlias otherdomain.com
SSLCertificateFile /etc/ssl/certs/san-certificate.crt
SSLCertificateKeyFile /etc/ssl/private/san-key.key
</VirtualHost>
# Nginx — wildcard covers all defined server_name entries:
server {
listen 443 ssl;
server_name yourdomain.com *.yourdomain.com;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
}
Decision Guide: Which Type to Choose
- You have one domain with many subdomains (SaaS platform, microservices): Wildcard — simpler management, any subdomain is covered automatically
- You manage multiple different client domains (agency, SaaS multi-tenant): Multi-domain SAN — one certificate can cover all client domains
- You need EV validation: SAN only — wildcard EV certificates do not exist
- You have deep subdomains (api.v2.yourdomain.com): SAN with explicit entries, or a second-level wildcard (*.api.yourdomain.com)
- You use Let's Encrypt and want simplest setup: Standard certificate per domain, or SAN for known subdomains (no DNS challenge needed)
- You're a developer with many test/staging subdomains: Wildcard — new subdomains are covered without any certificate changes
A wildcard certificate for
*.yourdomain.com does NOT automatically cover yourdomain.com (without the www/subdomain prefix). Always explicitly add both yourdomain.com and *.yourdomain.com to the SANs when requesting a wildcard certificate.Deploying Wildcard and Multi-Domain Certificates on Windows IIS
Windows Server
IIS
Generating a Wildcard CSR on Windows
:: Create csr.inf for a wildcard certificate
[Version]
Signature="$Windows NT$"
[NewRequest]
Subject = "CN=*.yourdomain.com, O=Your Company, L=City, S=State, C=US"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
RequestType = PKCS10
HashAlgorithm = SHA256
[EnhancedKeyUsageExtension]
OID = 1.3.6.1.5.5.7.3.1
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=*.yourdomain.com&"
_continue_ = "dns=yourdomain.com&"
:: Generate the CSR
mkdir C:\ssl
certreq -new C:\ssl\wildcard.inf C:\ssl\wildcard.csr
type C:\ssl\wildcard.csr
Deploying a Wildcard Certificate Across Multiple IIS Sites
Once you have the wildcard certificate in the Windows Certificate Store, you can bind it to multiple IIS sites from a single PowerShell script:
# Get the wildcard certificate thumbprint
$wildcard = Get-ChildItem Cert:\LocalMachine\My | `
Where-Object {$_.Subject -like "*\*.yourdomain.com*"}
$thumbprint = $wildcard.Thumbprint
Write-Host "Wildcard cert thumbprint: $thumbprint"
Write-Host "Expires: $($wildcard.NotAfter)"
# Bind to multiple IIS sites
Import-Module WebAdministration
$sites = @("site1.yourdomain.com", "site2.yourdomain.com", "api.yourdomain.com")
foreach ($site in $sites) {
# Add HTTPS binding
New-WebBinding -Name $site -Protocol https -Port 443 -HostHeader $site
# Assign wildcard cert
$binding = Get-WebBinding -Name $site -Protocol https
$binding.AddSslCertificate($thumbprint, "My")
Write-Host "Bound wildcard cert to $site"
}
Multi-Domain (SAN) Certificate on IIS
SAN certificates with multiple domains are handled identically to single-domain certs in IIS — import the PFX and bind it to each site. The SAN domains are embedded in the certificate itself and IIS will present the cert for any domain listed in the SAN.
# Import SAN cert PFX
$pw = ConvertTo-SecureString "exportPassword" -AsPlainText -Force
$cert = Import-PfxCertificate `
-FilePath "C:\inetpub\ssl\multi-domain.pfx" `
-CertStoreLocation Cert:\LocalMachine\My `
-Password $pw
# Verify all SANs are present
$cert.DnsNameList | Select-Object -ExpandProperty Unicode
Wildcard and SAN Certificates on macOS
macOS
Homebrew
On macOS with Homebrew Apache or Nginx, wildcard and SAN certificates are configured identically to Linux — point the SSL certificate directives at the combined cert file, which already contains all the SAN domains. No additional configuration is needed per-domain.
# Generate wildcard CSR on macOS with OpenSSL:
openssl genrsa -out wildcard.key 2048
# Create a config file for SAN:
cat > san.cnf <<EOF
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = State
L = City
O = Your Company
CN = *.yourdomain.com
[v3_req]
subjectAltName = DNS:*.yourdomain.com,DNS:yourdomain.com
EOF
openssl req -new -key wildcard.key -out wildcard.csr -config san.cnf
# After receiving the certificate from your CA:
# Homebrew Apache — point both sites at the same cert file:
# SSLCertificateFile /opt/homebrew/etc/httpd/ssl/wildcard.crt
# SSLCertificateKeyFile /opt/homebrew/etc/httpd/ssl/wildcard.key
# Trust a wildcard cert for local dev in macOS Keychain:
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain wildcard.crt
Check what your current certificate covers
Our SSL checker shows all SANs and domains in your certificate, whether it's a wildcard or multi-domain.