Wildcard vs Multi-Domain Certificates
Choosing the right certificate type for infrastructure spanning multiple subdomains or entirely separate domains.
Core Concept
Wildcard and multi-domain certificates both extend TLS coverage beyond a single hostname, but solve different problems and carry different trade-offs.
Choosing between them comes down to whether the infrastructure spans subdomains of one domain, or spans several unrelated domains entirely.
How Wildcard Certificates Work
A wildcard certificate covers a domain and all of its first-level subdomains under a single certificate.
- *.example.com covers app.example.com, api.example.com, etc.
- Does not cover the bare domain example.com without a SAN entry
- Does not cover second-level subdomains like a.b.example.com
Single Certificate, Many Hosts
One wildcard certificate can secure an unlimited number of first-level subdomains, simplifying management significantly for subdomain-heavy architectures.
How Multi-Domain (SAN) Certificates Work
Multi-domain certificates use Subject Alternative Names to cover an explicit list of distinct hostnames within one certificate.
- Can cover entirely unrelated domains in a single certificate
- Each covered hostname must be explicitly listed
- Adding a new domain requires reissuing the certificate
Security Trade-offs
Convenience comes with a genuine security consideration worth weighing carefully.
A compromised wildcard private key exposes every subdomain it covers simultaneously, making it a higher-value target than a certificate scoped to a single host.
Blast Radius
Wildcard certificates concentrate risk — one compromised key can affect an unbounded number of subdomains at once.
Choosing the Right Approach
The decision generally comes down to infrastructure shape and operational preference.
- Many subdomains under one domain → wildcard is simpler
- A handful of unrelated domains → multi-domain (SAN) fits better
- High-security environments → per-service certificates limit blast radius
Real-World Implementation
Certificate strategy varies widely based on organizational scale and risk tolerance.
- SaaS platforms using wildcards for customer subdomains
- Enterprises using SAN certificates to consolidate multiple brand domains
- High-security services issuing narrowly scoped certificates per component
Whichever type is chosen, automated issuance and renewal remain essential — the added coverage of wildcard and multi-domain certificates raises the stakes of an expiry mistake.
Common Mistakes to Avoid
A few common mistakes come up when choosing between wildcard and multi-domain certificates.
- Assuming a wildcard certificate automatically covers the bare domain without a SAN entry.
- Choosing a wildcard certificate for high-security environments without weighing the blast radius.
- Forgetting that multi-domain certificates require reissuance for every new hostname added.
- Overlooking nested subdomain coverage gaps in wildcard certificate planning.
- Failing to consider per-service certificates when compromise impact needs to be minimized.
- Overlooking cost differences between wildcard and multi-domain certificates at scale.
- Assuming certificate authority support for both types is universally identical.
- Failing to plan certificate renewal complexity differences between the two approaches.
- Overlooking hybrid approaches combining a wildcard with additional SAN entries.
- Assuming certificate transparency logging behaves the same for both certificate types.
- Failing to plan certificate rotation strategy differently for each type's specific risk profile.
- Overlooking that some certificate authorities price wildcard and multi-domain certificates very differently.
Best Practices Checklist
These practices help match certificate type to actual infrastructure needs.
- Choose a wildcard certificate for domains with many first-level subdomains needing simple coverage.
- Choose a multi-domain certificate for a handful of unrelated domains under shared management.
- Consider individually scoped certificates per service in high-security environments.
- Plan for SAN entry needs, like the bare domain, when configuring a wildcard certificate.
- Weigh the blast radius of a compromised key against the convenience each certificate type offers.
- Compare cost implications between wildcard and multi-domain approaches at your actual scale.
- Verify your chosen certificate authority's specific support for each certificate type.
- Plan for the renewal complexity differences, particularly for growing multi-domain certificates.
- Consider hybrid certificates combining a wildcard with additional specific SAN entries where useful.
- Understand certificate transparency logging implications, which apply to both certificate types.
- Tailor certificate rotation strategy to each type's distinct risk and management profile.
- Compare actual pricing between wildcard and multi-domain options at your chosen certificate authority.
Frequently Asked Questions
Frequently asked questions about wildcard versus multi-domain certificates.
Does a wildcard certificate cover the bare domain too?
Not by default — it typically requires an explicit SAN entry to also cover the domain without a subdomain prefix.
What's the main security trade-off of a wildcard certificate?
A compromised wildcard private key exposes every subdomain it covers simultaneously, concentrating risk more than a narrowly scoped certificate.
Can a multi-domain certificate cover completely unrelated domains?
Yes — using Subject Alternative Names, it can cover an explicit list of distinct hostnames within a single certificate.
Which certificate type is easier to manage for a growing SaaS platform?
A wildcard certificate is generally simpler, since it automatically covers new first-level subdomains without needing reissuance.
Are individually scoped certificates ever worth the extra overhead?
Yes, particularly in high-security environments, since they limit the impact of any single key compromise despite the added management burden.
Is one certificate type generally cheaper than the other?
Cost structures vary by certificate authority, so comparing at your actual scale of use is more reliable than assuming one is inherently cheaper.
Do all certificate authorities support both wildcard and multi-domain certificates?
Most major ones do, but specific features and pricing can differ, making verification worthwhile before committing.
Does a growing multi-domain certificate get harder to manage over time?
Yes — each new domain added requires reissuance, which can become more complex to coordinate as the covered domain list grows.
Can a certificate combine a wildcard with additional specific domains?
Yes — a hybrid approach using both a wildcard entry and specific additional SAN entries is a valid, sometimes useful configuration.
Does certificate transparency logging apply differently to wildcards versus multi-domain certs?
Both are logged under the same CT requirements, though a wildcard certificate's logged entry reveals less about specific subdomains in use.
Is pricing consistent between wildcard and multi-domain certificates?
Not necessarily — pricing structures can differ meaningfully between certificate authorities, making direct comparison worthwhile.
Check Certificate Coverage
Run an SSL check to see exactly which domains and subdomains a certificate covers.
Launch Tool →