Platform Notes
Hosting for wildcard SSL — One label of depth, and everything that follows from it
Your platform creates a subdomain per customer at signup, and certificate issuance is the step that will break first — quietly, at whatever hour the hundredth tenant registers.
The short answer
Match the certificate to who creates the subdomains. If a human adds them occasionally, free SSL issued per subdomain and renewed automatically covers you at no cost. If your application creates them programmatically, buy the wildcard at $169.99 so a name is covered the instant it exists.
The constraint that decides most of this: a wildcard is valid for exactly one label of depth. A certificate for *.yourdomain.example covers app.yourdomain.example and store.yourdomain.example, and does not cover eu.app.yourdomain.example. Anything nested deeper needs its own certificate.
Below: where the break-even actually sits, the automation debt that catches multi-tenant platforms, and the two commands that tell you exactly which names a live certificate covers.
By the HostingFast team · Reviewed 24 August 2026
Free
Migration, run by us
24/7
Humans on the desk
Daily
Backup cadence
$0
Joining fee
Certificates are one of the few parts of a stack where the failure is total and instantaneous: either the browser trusts the name or it shows a full-page warning and the visitor leaves.
That makes this a question about issuance mechanics rather than about encryption. All of these certificates encrypt identically. What differs is which names are covered, who has to act for a new name to be covered, and how that scales.
The depth rule, stated precisely
A wildcard replaces exactly one label. *.yourdomain.example matches app, store, clients and any other single label in that position. It does not match a name with an extra dot in it, so eu.app.yourdomain.example falls outside it entirely.
The consequence for architecture is real. A platform that assigns customer.yourdomain.example is fully covered by one wildcard. A platform that assigns customer.region.yourdomain.example needs a wildcard per region, or a different naming scheme.
It is much cheaper to discover this while the naming scheme is still a decision. Flattening tenant names to a single label at design time removes an entire class of certificate work permanently.
Where the break-even really sits
Not at a subdomain count — at a question about who creates them. Free SSL on every plan issues per name and reissues before expiry, which handles a fixed set of subdomains perfectly and costs nothing. Ten hostnames you added by hand are ten certificates you never think about again.
It stops working when names appear without a human present. If signup provisions a subdomain, then issuance has to happen in that same moment, and any automated flow is subject to the certificate authority's own issuance rate limits — a constraint that stays invisible right up until a busy launch day.
The wildcard at $169.99 covers every subdomain, which converts issuance from a per-name event into a one-off. For a genuine multi-tenant platform that is the cheaper answer even at modest scale, because the thing you are buying is the removal of a failure mode rather than a quantity of certificates.
Where organisation identity matters rather than coverage, EV at $379.99 is a different product answering a different question — vetting, not reach. Do not buy it for subdomains.
Verifying coverage instead of assuming it
Two commands settle it. `openssl s_client -connect app.yourdomain.example:443 -servername app.yourdomain.example </dev/null 2>/dev/null | openssl x509 -noout -text` prints the certificate, and the Subject Alternative Name section lists every name it is valid for.
For a quick expiry check, `openssl s_client -connect yourdomain.example:443 -servername yourdomain.example </dev/null 2>/dev/null | openssl x509 -noout -dates` gives you notBefore and notAfter without a browser in the way.
Do this from outside your own network, and do it for a name your automation created rather than one you added by hand. The name a person made is not the one that will fail.
The rest of the setup that has to hold
Every plan includes free SSL that reissues itself before expiry, so an expired certificate is never the cause of your outage. That covers the ordinary case completely.
Behind it, the platform provides what the certificate does not: DDoS filtering at the network edge, NVMe storage with LiteSpeed caching, daily backups with self-service restores, and human support at every hour for the day a chain or an intermediate looks wrong.
Money-back cover runs to 30 days on hosting plans and 7 on reseller. And the certificate is only ever half the job — a padlock says the transport is encrypted, not that the application behind it is sound.
Why we will talk you out of the paid one
Most people asking about wildcards have a fixed handful of subdomains and are perfectly served by the free automation. Saying so costs us $169.99 and saves a customer from buying a solution to a problem they do not have.
We sell both routes, which we would rather state than imply neutrality. The depth rule and the verification commands hold wherever you buy.
- One label of depth, no exceptions
- Free per-name issuance for a fixed set
- $169.99 wildcard when names appear programmatically
- Coverage verified with openssl, not assumed
Why HostingFast
Standard on every plan
Free SSL that renews itself
Issued as soon as a name points here and reissued before expiry, on every plan, so a lapsed certificate is never your outage.
A wildcard when automation demands it
One certificate at $169.99 covering every first-level subdomain, so a tenant created at 3am is covered at 3am.
EV for a different question
Extended validation at $379.99 puts a vetted organisation name on the certificate. Assurance, not coverage — and rarely both.
A depth rule stated up front
One label, and nothing nested deeper. Knowing that while the naming scheme is still a decision saves an entire class of work.
Verification you can run yourself
Two openssl commands print exactly which names a live certificate covers and when it expires. No dashboard required.
Support for the awkward cases
Humans at every hour for the chain that looks wrong, the intermediate that will not install, or the name that failed to issue.
Quick Start
From order to online
- 1
Count the labels, not the subdomains
If any hostname has a dot inside the wildcard position, one certificate will not cover your estate. Fix the naming scheme first.
- 2
Decide who creates new names
A person adding them occasionally means free issuance is enough. An application creating them means buy the wildcard.
- 3
Verify a machine-created name
Run the openssl check against a hostname your automation produced, from outside your network. That is the one that fails.
- 4
Put expiry on a schedule you can see
Automatic reissue handles the routine case; a monthly check of notAfter dates catches the exception before a visitor does.
Built In
Loaded onto every plan
- Free SSL on every plan, reissued automatically before it can expire
- Wildcard SSL at $169.99, covering every first-level subdomain
- EV SSL at $379.99 where organisation validation is the requirement
- Full SSH with the openssl client available for verification
- A 99.9% uptime target, backed by a pro-rated credit if a month falls short
- Daily backups with self-service restores from the panel
- LiteSpeed caching in the web server rather than added by plugin
- Volumetric traffic scrubbed at the network edge before the machine sees it
- NVMe underneath every plan, which is what an uncached read waits on
- No year-two reset: the rate you join at is the rate you keep
- 30 days to change your mind on hosting, 7 days on reseller
- Your existing site moved across by our engineers, free of charge
Frequently Asked
What people ask us most often
Does a wildcard cover a name like eu.app.yourdomain.example?
No. A wildcard replaces exactly one label, so *.yourdomain.example covers app and store and clients, and stops at the next dot. Anything nested deeper needs its own certificate or its own wildcard. If your naming scheme is still a decision, flattening tenant names to one label removes the problem permanently.
How do I check which names a live certificate actually covers?
Run `openssl s_client -connect host:443 -servername host </dev/null 2>/dev/null | openssl x509 -noout -text` and read the Subject Alternative Name section, which lists every valid name. Swap `-text` for `-dates` to get notBefore and notAfter. Test a hostname your automation created rather than one you added by hand.
When does $169.99 beat free per-subdomain certificates?
When subdomains appear without a human present. If a signup provisions a tenant hostname, issuance has to succeed at that moment and automated flows sit under the certificate authority's rate limits. A wildcard converts issuance from a per-name event into a one-off, which is what you are actually paying for.
Is the bare domain included, or only the subdomains?
Ours are configured to cover both the domain and its first-level subdomains together, which is the arrangement you want. It is worth confirming that explicitly wherever you buy a wildcard, because a certificate that covers *.yourdomain.example but not yourdomain.example itself will fail on your homepage.
Keep reading
Hosting With a Free Domain
The registration side of the same decision, and what the included first year does and does not cover.
Cheap Dedicated Servers
Multi-tenant platforms outgrow shared allocations before they outgrow certificates. This is the next constraint.
Wildcard SSL (Glossary)
The definition and the depth rule with a worked example, for when someone else needs convincing.
SSL Certificates
Free SSL on every plan, wildcard at $169.99 and EV at $379.99, with what each one is actually for.
Web Hosting
cPanel hosting on NVMe behind LiteSpeed, with automatic certificate issuance on every hostname you add.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Cover the names before they exist.
Free SSL on every plan and a wildcard at $169.99 when your application starts creating subdomains without you.
View SSL Certificates plans