Wildcard SSL Certificate

A Wildcard SSL certificate protects your domain and all subdomains under it with one certificate. Instead of buying separate certificates for www, mail, shop and intranet, one Wildcard covers them all.

But wildcards have rules. This page explains exactly what * covers and what to do when you need more.

How wildcard matching works

The asterisk * replaces one arbitrary label, i.e. text without a dot. The asterisk cannot match a dot (.), and it cannot be empty.

*.fairssl.dk

Matches any name that has exactly one label before .fairssl.dk

✓ www.fairssl.dk ✓ mail.fairssl.dk ✓ anything.fairssl.dk

✗ sub.sub.fairssl.dk ✗ fairssl.dk

* The root domain (fairssl.dk) is automatically included by the CA, but technically it is not the asterisk that matches it.

Example: One certificate with multiple wildcards

Imagine your certificate contains these three names:

*.fairssl.dk *.sub.fairssl.dk fairssl.dk

These names are covered

✓
fairssl.dk , root domain
✓
www.fairssl.dk , matches *.fairssl.dk
✓
mail.fairssl.dk , matches *.fairssl.dk
✓
shop.fairssl.dk , matches *.fairssl.dk
✓
api.sub.fairssl.dk , matches *.sub.fairssl.dk
✓
staging.sub.fairssl.dk , matches *.sub.fairssl.dk
✓
sub.fairssl.dk , matches *.fairssl.dk ("sub" is one label)

These names are NOT covered

✗
deep.api.sub.fairssl.dk , 2 levels below sub
✗
other.example.com , entirely different domain

Have names that don't match a wildcard?

You can always add individual domain names as extra SAN fields in the certificate. If you also need deep.api.sub.fairssl.dk or legacy.example.com, simply add those names individually. Most wildcard certificates support multi-domain (SAN).

The rules in brief

The asterisk = one label

* matches one arbitrary label without a dot. www, mail, api123, all are valid.

The dot = boundary

The asterisk cannot match a dot. That is why *.a.dk does not cover x.y.a.dk, that is two levels.

Add more names

Missing a name? Add it individually as a SAN. You can mix wildcards and specific names in one certificate.

DV Wildcard vs. OV Wildcard

	DV Wildcard	OV Wildcard
Price	From €161/year	See current price
Validation	Domain only	Organisation identity
Issuance	~10-30 min	1-3 days
Organisation name	✗	✓
Best for	Blogs, SaaS, dev	Businesses, e-commerce

Validation: DNS is required

Wildcard certificates require DNS-01 validation: you need to add a TXT record to your domain's DNS. HTTP-01 validation is not supported for wildcards.

With FairSSL's AutoDNS you set a permanent CNAME record once, and we handle DNS validation automatically at every renewal, including via ACME.

Read about ACME automation with AutoDNS →

Wildcard certificates

DV Wildcard

Thawte SSL123 Wildcard

DV wildcard from DigiCert. Can also add individual SAN names.

from €228 €147 /year See details →

AlphaSSL Wildcard - NEW ROOT 2024

GlobalSign wildcard. Low price, high compatibility.

from €160 /year See details →

Sectigo PositiveSSL WC

Wildcard DV from Sectigo for all subdomains at one level.

from €147 €134 /year See details →

OV Wildcard

DigiCert Basic OV Wildcard

OV wildcard from DigiCert. Organisation name in certificate.

from €723 /year See details →

GlobalSign OV SAN Wildcard

GlobalSign OV wildcard with SAN support.

from €717 /year See details →

GeoTrust True BusinessID Wildcard

GeoTrust OV wildcard. Strong trust at low price.

from €401 /year See details →

See all products with prices →

Frequently asked questions about Wildcard SSL

Find answers to the most common questions about SSL certificates and FairSSL.

Which extra names (SAN) are free?

When you order any SSL certificate via the website, we automatically add the base name for free: if the common name is www.example.com, example.com is added, and if it is *.example.com, the base domain example.com is added. On certificates from the DigiCert family (RapidSSL, Thawte, GeoTrust, DigiCert) this also applies when the www or wildcard name is added as a SAN, and names the wildcard covers, such as www.example.com or shop.example.com, can be added as free SANs. Names on a different level than the wildcard, or on a different domain, are charged as regular SAN names. With ACME there is no automatic addition, you list all names yourself, but the base name is still free when you include it.

Does a Wildcard certificate cover the root domain?

When ordering via the website, the root domain (e.g. fairssl.dk) is added automatically and free when you order *.fairssl.dk, on any product. On DigiCert-family certificates (RapidSSL, Thawte, GeoTrust, DigiCert), the other names the wildcard covers are also free. With ACME you list all names yourself, including the root domain.

Can I use one Wildcard on multiple servers?

Yes. Wildcard certificates have unlimited server installations. Use it on your web server, mail server, load balancer, etc. simultaneously.

Does *.fairssl.dk also cover sub.sub.fairssl.dk?

No. Wildcards only cover one level. For sub.sub.fairssl.dk you need to either add the name as an individual SAN domain or use a separate wildcard *.sub.fairssl.dk.

Can I mix wildcard and individual names in one certificate?

Yes. Multi-domain certificates can contain wildcards and specific names in combination. For example *.fairssl.dk + *.app.fairssl.dk + legacy.example.com in one certificate.

What happens with shorter SSL lifetimes and Wildcard?

An SSL certificate can be valid for at most 199 days now, 99 days from 15 March 2027 and 47 days from 15 March 2029. Wildcard certificates are affected equally. We recommend setting up SSL Automation with DNS validation so renewal happens automatically.

Is a Wildcard cheaper than many single-domain certificates?

Yes. With 3 or more subdomains, a Wildcard is almost always cheaper than separate certificates. You can add new subdomains at any time without ordering a new certificate.

Secure all your subdomains with one certificate

Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.

Create free account Compare certificates