If you have multiple domains or subdomains (or both), choosing the right SSL type can seem tough. Wildcard and multi-domain SSL certificates might seem very similar at first glance, but they ultimately serve different requirements. Let’s take a closer look.
The short answer
A wildcard SSL secures one primary domain and unlimited first-level subdomains linked to it. Meanwhile, a multi-domain SSL can secure multiple domains and subdomains via subject alternative name (SAN), an extension that allows one certificate to protect multiple domain names.
Encryption is the same for both, so the deciding factor in choosing is your domain structure.
What is a wildcard SSL certificate?
So what do you get with a wildcard SSL? As an example, if you own example.com, it would cover first-level subdomains that look like *.example.com. That would cover things like:
- shop.example.com
- blog.example.com
- mail.example.com
Where its convenience truly shines is its automatic coverage of subdomains. Even if you create a slew of subdomains after receiving your SSL, these domains will be protected without you having to reissue the SSL. This flexibility makes it an ideal choice for businesses with multiple regional sites or dev staging environments.
The “unlimited” aspect of wildcard SSLs may sound very impressive, but it does have limitations since it will only protect first-level subdomains, not all subdomains. Something like dev.shop.example.com won’t be protected.
A very niche factor to be aware of is that the primary domain (example.com) may not always be secured automatically either. Though it is added as an SAN for most commercial wildcard certificates (like on SSLs.com), for some you may need to add it manually.
What Is a multi-domain SSL certificate?
A multi-domain certificate offers more flexible domain and subdomain coverage than a wildcard certificate. It’s not limited to primary-level subdomains either. How many domains and subdomains it secures depends on the vendor. For example, on SSLs.com, it’s 3 to 100.
A slight downside is that multi-domain coverage is not automatic like with a wildcard. Just adding *.example.com will not secure all associated subdomains. Every time you create a new domain or subdomain, it must be manually added to the certificate as a SAN. And every time you add a new SAN, the SSL must be reissued.
Multi-domain SSLs are a good fit for businesses running multiple brand websites or country-specific websites, particularly if they’re a fixed set of sites.
Key differences
Here are the key differences between wildcard certificates and multi-domain certificates laid out side by side.
| Feature | Wildcard SSL | Multi-Domain SSL |
| Purpose | Subdomains of one domain | Multiple listed domains |
| Different base domains | No | Yes |
| First-level subdomains | Covered | Listed or via wildcard SAN |
| Root domain | Product-dependent | Listed as SAN |
| New subdomains | No reissuance | Reissuance needed |
| Validation | DV, OV (no EV) | DV, OV, EV |
| CT log visibility | Shows only *.example.com | Shows every hostname |
| Key exposure | One key, all subdomains | One key, all SANs |
Which is easier to manage?
A wildcard SSL is slightly easier to manage with some caveats. Once you validate the primary domain, every current and future subdomain is automatically covered. It’s much easier to set it and forget it, as you only need to validate it once until it’s time for the industry-mandated revalidation, which is every 200 days. Domain validation for wildcard SSLs also has some limitations. HTTP file validation isn’t permitted, so you’ll need to do email or DNS validation instead.
With a multi-domain SSL you need to perform validation for every individual domain. So if you have five domains, you need to perform validation five times. And if you add a domain later, the certificate will need to be reissued too.
In the end, though, your specific needs dictate whether you choose a wildcard or multi-domain SSL. With shrinking SSL lifetimes, setting up automation with ACME will make life much easier, whatever type you choose.
Is one safer – wildcard or multi-domain?
Neither SSL type is inherently more or less safe. Private key compromise is relatively uncommon, though it is serious if it does happen. So if you’re concerned, here are a few things to consider.
- Encryption – Both certificate types offer the same level of encryption. Its strength depends on your particular server settings, not the SSL itself.
- Compromise impact – For both, the same private key is used across multiple servers, which can increase the potential for it to be stolen. While a stolen wildcard could impersonate any subdomain, even one that doesn’t exist yet, a stolen multi-domain key can impersonate every listed domain.
- Revocation – If an SSL is compromised and then revoked, you’ll need to reinstall the reissued SSL on each server, which risks downtime.
- Isolation – To limit damage if a wildcard or multidomain SSL is compromised, consider using separate certificates on sensitive services like payments or admin panels.
- The downside of CT logs – Every public SSL is recorded in public Certificate Transparency (CT) logs. A multi-domain SSL lists every hostname it secures, which can link separate brands together. By contrast, a wildcard only shows *.example.com. However, your subdomains can still be found in other ways.
What affects the cost?
The cost of SSLs generally differ between providers. Here are some other factors that can impact things:
- Validation level – DV is the cheapest, followed by OV, then EV. And EV is not available for Wildcard SSLs.
- Number of domains – Multi-domain SSLs can secure up to 100 domains, but 100 domains aren’t automatically included. You must pay for each domain you add.
- Wildcard premium – A wildcard SSL is only worth it if you have enough subdomains to justify the cost. If you only have two or three, a multi-domain SSL may be better.
- Running costs – While validation, reissues, and deployment are usually free, they take time, and a missed renewal can cause an outage and cost you in the long term.
It’s also helpful to remember that the cheapest to buy isn’t necessarily the cheapest to run. While multi-domains are initially cheaper than a Wildcard, if you’re adding extra domains and subdomains over the next year, costs will add up quickly. So try to plan for the future before committing.
Wildcard vs. multi-domains: Which should you choose?
Ultimately, it will boil down to your particular domain setup.
- Wildcard: Perfect if you have many first-level subdomains on one domain and plan on adding more later.
- Multi-domain: Ideal if you have many distinct domains or TLDs, a fixed hostname list, or need an EV SSL.
- Combination or separate certificates: If you have multiple domains with their own subdomains, independent keys, or want more strict isolation on areas like payment processors, getting both wildcard and multi-domain SSLs could be the answer.
The takeaway
When it comes to choosing an SSL, there’s never a universal “best choice.” It’s always going to depend on your particular needs, your website type, how many domains and subdomains you have, and taking into account how that might change down the road. Once you have all that mapped out, choosing between a wildcard and multi-domain SSL is easy.
Frequently asked questions
Does a Wildcard cover second-level subdomains?
No. A wildcard SSL for *.example.com would only cover subdomains like blog.example.com or mail.example.com. For something like dev.mail.example.com you would need either a second wildcard SSL or add it to a multi-domain SSL.
Can I get an EV Wildcard certificate?
No, EV is not available for wildcard SSL certificates. Only DV and OV.
Can I add domains to a multi-domain certificate later?
You can, but it costs extra for every new name. You also need to validate the domain, reissue the SSL, and reinstall it across each server.
Does Google prefer either type?
Google has no preference for what kind of SSL you have; it only cares that you have an SSL at all.
Aideen is a digital copywriter for SSLs.com. Having eight years of experience in online content creation, she is a versatile writer with an interest in a wide variety of topics, ranging from technology to marketing.