What Is Wildcard SSL?
A Wildcard SSL Certificate is a type of SSL designed to secure a primary domain and all of its subdomains at a single level under one certificate. It uses an asterisk (*) in place of the subdomain name in the format *.domain.com, automatically covering every subdomain created under that domain.
For example, purchasing a single Wildcard SSL for *.yourdomain.com covers shop.yourdomain.com, blog.yourdomain.com, api.yourdomain.com, mail.yourdomain.com — and any new subdomains you add in the future — without needing additional certificates.
Important: A Wildcard SSL only covers one subdomain level. For example, *.domain.com secures shop.domain.com but does NOT secure dev.shop.domain.com (a second-level subdomain). You would need a separate certificate for nested subdomains.
What a Wildcard Covers — and What It Does Not
The core idea of a Wildcard SSL is that the asterisk * stands in for exactly one subdomain level. Before you buy, it helps to know precisely what a single certificate covers and where its boundary lies, so you never hit a "name mismatch" error when subdomains go live.
What *.domain.com covers
- Every single-level subdomain — shop.domain.com, blog.domain.com, api.domain.com — with no quantity limit and no need to declare names in advance.
- Subdomains you create later — if you have three today and add promo.domain.com tomorrow, the same certificate covers it instantly.
- The apex/root domain in most cases — most CAs include both
*.domain.comanddomain.comin the certificate's SAN, so the bare domain.com (without www) is secured too.
What *.domain.com does NOT cover
- Multi-level (nested) subdomains like dev.shop.domain.com or a.b.domain.com — *.domain.com only matches one level, so it does not protect a subdomain of a subdomain.
- Different domain names — a *.domain.com certificate cannot secure domain.net or otherbrand.com. For that you need a Multi-Domain (SAN) SSL.
- Deeper wildcards — securing *.shop.domain.com requires a second, dedicated wildcard certificate, or a certificate that names the inner subdomains explicitly.
Quick rule: the * replaces only the single leftmost label. If your site has deeply nested subdomains, plan additional certificates from the start.
Wildcard SSL vs Single Domain SSL
A Single Domain SSL (standard DV SSL) is issued for one specific domain only — for example www.yourdomain.com or shop.yourdomain.com. To protect additional subdomains, you must purchase separate certificates for each one.
| Feature | Single Domain SSL | Wildcard SSL |
|---|---|---|
| Domains covered | 1 domain | Primary domain + unlimited subdomains |
| Format | www.domain.com | *.domain.com |
| Add new subdomains | Must buy more certificates | Covered automatically |
| Price | From THB 1,000/year | Higher, but cheaper than buying separate certificates |
| Best for | Single-subdomain sites | Sites with multiple subdomains |
Wildcard vs Single Domain vs SAN/Multi-Domain
Beyond Single Domain and Wildcard, there is a third type called SAN (Subject Alternative Name) or Multi-Domain SSL, which packs several distinct domain names into one certificate. The difference: a Wildcard covers unlimited subdomains of one domain, while a SAN certificate secures each domain or subdomain you specify by name. This table makes it easy to pick the right type:
| Aspect | Single Domain | Wildcard | SAN / Multi-Domain |
|---|---|---|---|
| What it secures | www.domain.com | *.domain.com | Multiple named domains/subdomains in one cert |
| Different domain names (.com + .net) | No | No | Yes |
| Unlimited subdomains | No | Yes (one level) | Only those named |
| Add new subdomains later | Must reissue | Automatic | Must reissue |
| Best for | One site, one subdomain | One domain, many subdomains | Multiple brands/domains with known names |
| Starting price (at AsiaGB) | THB 1,000/year | THB 5,000/year | Depends on domain count |
How to choose: if every subdomain sits under one domain, a Wildcard is the best value. If you must secure several different domain names (.com, .co.th, .net), choose SAN/Multi-Domain. If you truly run a single site, a Single Domain certificate is cheapest.
Real-World Use Cases for Wildcard SSL
Businesses and projects with multiple subdomains find that Wildcard SSL saves both money and management overhead compared to buying individual certificates. Here are common real-world scenarios:
E-commerce Store
- shop.yourdomain.com — storefront
- cart.yourdomain.com — shopping cart
- api.yourdomain.com — API for mobile app
- admin.yourdomain.com — back-office dashboard
Corporate Website
- www.yourdomain.com — main website
- blog.yourdomain.com — company blog
- mail.yourdomain.com — webmail
- support.yourdomain.com — help desk / ticket system
- crm.yourdomain.com — internal CRM
SaaS or Multi-Tenant Platform
- client1.yourdomain.com — customer A workspace
- client2.yourdomain.com — customer B workspace
- app.yourdomain.com — main application
- staging.yourdomain.com — staging environment
Who Should Use Wildcard SSL?
Wildcard SSL is the most cost-effective choice for businesses or projects with the following characteristics:
- You currently have or plan to have three or more subdomains
- You frequently create new subdomains and don't want to buy new SSL certificates each time
- You manage multiple environments (production, staging, dev) under the same domain
- You run a multi-tenant platform where each customer gets their own subdomain
- You want to reduce total SSL spending by consolidating multiple certificates into one
- You prefer managing a single certificate instead of tracking renewal dates for multiple certificates
When Wildcard SSL Is Not the Right Choice
In some situations, a Wildcard SSL may not be the most cost-efficient solution:
- You only have one subdomain or none at all — a Single Domain SSL will be cheaper
- You need EV (Extended Validation) SSL — EV Wildcard certificates carry a premium price; many organizations prefer buying EV only for the primary domain
- You need to secure deeply nested subdomains like a.b.domain.com, which require multi-level wildcards
Cost comparison example: If you need SSL for 5 subdomains and purchase Single Domain SSLs separately, the combined cost will exceed the price of a single Wildcard SSL certificate. The more subdomains you have, the greater the savings with Wildcard.
Which Certificate Authorities Issue Wildcard SSL?
Wildcard SSL can be issued by several trusted Certificate Authorities (CAs). AsiaGB offers Wildcard SSL from leading global brands:
- GeoTrust — one of the most trusted CAs worldwide, compatible with all major browsers
- DigiCert — enterprise SSL market leader, known for high-assurance security
- RapidSSL — fast issuance and excellent value, ideal for small to medium businesses
All three CAs provide Wildcard SSL with full browser compatibility, including Chrome, Firefox, Safari, Edge, and all major mobile browsers on iOS and Android.
What You Need to Know Before Installing a Wildcard SSL
Installing a Wildcard SSL is not very different from installing a standard certificate, but a few points are worth understanding up front so that every subdomain works smoothly and browsers never flag it as insecure:
- Generate the CSR with *.domain.com — when creating the Certificate Signing Request, set the Common Name to
*.domain.com(not www.domain.com), otherwise the certificate will not cover your subdomains. - One certificate set works on every subdomain — once you have the certificate file (.crt), private key (.key) and CA bundle/intermediate, use the same set across all subdomains that point to your server.
- Install the full chain — don't forget the intermediate certificate (CA bundle), or some browsers, especially on mobile, may report the certificate as incomplete.
- Each subdomain needs correct DNS — a Wildcard only protects subdomains whose DNS (A/CNAME record) points to the server where the certificate is installed.
- Multiple servers can share one certificate — if subdomains live on different machines (for example, mail on a separate server), you may copy the same certificate and private key to each one — this is permitted.
- Verify after installation — open several subdomains and check the browser padlock, or use an SSL Checker tool to confirm the certificate name and full chain on every subdomain.
Security note: because a single private key is shared across every subdomain, a key leak would compromise all of them at once. Store the private key securely and restrict file access permissions on the server.
How to Get Started with Wildcard SSL
- Purchase a Wildcard SSL from AsiaGB and specify your domain in the format *.yourdomain.com
- Verify domain ownership via Email, DNS record, or HTTP file validation
- Receive your certificate — DV Wildcard is typically issued within 1 hour
- Install on your server — one certificate file covers all subdomains
- Add new subdomains anytime — they are automatically protected without requesting a new certificate
Frequently Asked Questions About Wildcard SSL
How many subdomains does a Wildcard SSL cover?
There is no limit on subdomains at the same level. A single *.domain.com certificate secures shop.domain.com, blog.domain.com, api.domain.com and any others — including subdomains you create in the future — without issuing a new certificate.
Does a Wildcard cover nested subdomains like dev.shop.domain.com?
No. The * matches only the single leftmost level, so *.domain.com secures shop.domain.com but not dev.shop.domain.com. To protect an inner level you need a separate wildcard such as *.shop.domain.com, or a certificate that names those subdomains explicitly.
How much does a Wildcard SSL cost at AsiaGB?
Wildcard SSL at AsiaGB starts at THB 5,000/year (RapidSSL Wildcard, one-year price). GeoTrust QuickSSL Premium Wildcard and the OV-grade GeoTrust True BusinessID Wildcard are also available for organizations that need higher-assurance validation.
Does a Wildcard SSL work for both www and non-www?
In most cases, yes. CAs typically include both *.domain.com and domain.com in the same certificate, so www.domain.com (a subdomain) and the bare domain.com both load securely over HTTPS.
Get Wildcard SSL from AsiaGB
Wildcard SSL from GeoTrust and DigiCert — cover unlimited subdomains with one certificate. Easy installation, full browser support, and expert support throughout the certificate lifetime.
View Wildcard SSL Plans