Engineering Glossary · Transport Security
Wildcard SSL — Wildcards: One Level Deep, One DNS Challenge
The reason to reach for a wildcard is never encryption; it is removing a step from provisioning that can fail at three in the morning.
The short answer
A wildcard SSL certificate secures a domain plus all of its first-level subdomains — *.example.com covered by one credential, including names that did not exist on the day it was issued.
That last property is the whole engineering argument. Per-name issuance is a step in your provisioning path, and a step can fail: a rate limit, a DNS record not yet propagated, a challenge that could not be served because the new hostname was not routable yet. A wildcard removes the step entirely, so a subdomain created at three in the morning is HTTPS-ready the instant it resolves.
By the HostingFast team · Reviewed 24 August 2026
100+
Terms in the glossary
2 min
Average read time
Plain
English throughout
24/7
Humans if you get stuck
One credential covers app., shop., portal. and whatever somebody spins up next week — names that were not in existence on the day it was issued. That point is what separates it from requesting a certificate per name.
The asterisk reaches exactly one level down. Go a level deeper, to sub.sub.example.com, and you need a separate arrangement; in practice the certificate is issued listing the bare domain next to the wildcard so neither is left out.
Exactly what the asterisk covers
One label, no more. app.example.com and shop.example.com are covered; a.b.example.com is not, because that is two labels below the domain and the asterisk substitutes for exactly one. A client presented with a wildcard certificate for a deeper name will refuse the connection, which is the correct behaviour and a surprise to almost everyone the first time.
The bare domain is a separate case. Strictly, *.example.com does not match example.com itself, which is why certificates are normally issued naming both. Check the subject alternative names on any wildcard you are handed rather than assuming, because a certificate missing the bare domain will fail on your apex the moment somebody types it without a subdomain.
The argument is provisioning, not cryptography
Encryption is identical whether the certificate names one host or covers a hundred. What differs is how many moving parts sit between creating a subdomain and serving it securely. Per-name issuance means an ACME exchange at provisioning time, and that exchange has real failure modes: rate limits when you create in bursts, DNS not yet visible to the authority, or a hostname not routable until a deploy completes.
So the threshold is operational. A fixed handful of subdomains does not justify a wildcard — automated per-name certificates handle those perfectly well and cost nothing. Subdomains appearing on demand, by the dozen, or created by customers rather than by you, do justify it, because the certificate step is exactly the kind of thing that fails while nobody is watching.
Wildcards force the DNS challenge
There is no hostname a wildcard can serve a file from, so the http-01 challenge is unavailable and issuance runs over dns-01 — a TXT record under _acme-challenge that the authority resolves. That is not a preference; it is a constraint of the specification.
The practical consequence is that whatever issues the certificate needs write access to your DNS zone, and it needs it every renewal rather than once. If the zone lives with a provider the automation cannot reach, or behind credentials that expire, the wildcard will issue once and then quietly fail to renew — which is the least convenient failure mode available, given what a wildcard is normally protecting.
Where this lands on HostingFast
Free SSL on every plan handles per-name certificates automatically, so most sites never need a wildcard at all. From the Turbo tier up you can run multiple sites in one account, each with its own domain, mailboxes and certificate; if the extra sites belong to clients rather than to you, reseller hosting keeps each one properly walled off.
Read next: Let's Encrypt for the automation and its challenges, SSL Certificate for the credential, Subdomain for what the asterisk is matching, and HTTPS for what runs on top.
Definitions written for people who deploy
To us, jargon nobody explained is a service defect. This glossary is the support team's collected translations — published with the constraints, the failure modes and the thresholds still in them.
Already hosted somewhere slower? We migrate the whole site free, usually within 24 hours, and it keeps serving visitors the entire time.
- 100+ entries, each with the mechanism spelled out
- Commands you can paste, numbers you can compare against
- Neighbouring terms wired together at the foot of every page
- Written by the engineers who answer the tickets
Why HostingFast
Standard on every plan
Boundaries stated exactly
One label, not two, and the bare domain listed separately — the specifics that decide whether a client connects.
The threshold, not the pitch
Where an upgrade is only worth it past a certain scale, the entry says what that scale actually looks like.
Constraints flagged early
A wildcard forces the DNS challenge, which changes what your automation needs access to. Better known before purchase.
Failure modes named
Issues once and never renews is a real outcome, and the entry says which condition produces it.
Wired to its neighbours
Wildcard SSL runs into Let's Encrypt, SSL Certificate and Subdomain — the automation, the credential and the name.
This term, landed
Wildcards defined, bounded, and priced in operational terms — enough to decide whether you need one at all.
Quick Start
From order to online
- 1
Check the subject alternative names
Confirm both example.com and *.example.com appear. A wildcard without the bare domain fails on the apex the first time someone omits the subdomain.
- 2
Count how subdomains get created
A fixed handful means per-name certificates are fine. On demand, by the dozen, or created by customers means the certificate step is worth removing.
- 3
Give the automation durable DNS access
dns-01 runs at every renewal, not just at issuance. Credentials that expire turn a wildcard into a certificate that lapses quietly.
Built In
Loaded onto every plan
- Free SSL on every plan, renewed automatically before it can lapse
- Multiple sites in one account from the Turbo tier up
- Reseller hosting when the extra sites belong to clients rather than you
- LiteSpeed caching built into the server rather than bolted on by plugin
- cPanel, so subdomains and certificates sit on screens you know
- Per-site PHP version switching from the control panel
- Real SSH, plus Git and Composer, on the developer-focused plans
- Daily backups with self-service restores you run yourself from the panel
- Year one of your domain free when you order annually
- Zero setup charges — there is no joining fee, ever
Frequently Asked
What people ask us most often
Does a wildcard cover a.b.example.com?
No. The asterisk substitutes for exactly one label, so app.example.com is covered and a.b.example.com is not. A client offered a wildcard certificate for a two-label name will refuse the connection rather than accept it loosely. Deeper nesting needs its own certificate, or its own wildcard issued at that level.
Is example.com itself on the certificate?
It should be, but check rather than assume. Strictly, *.example.com does not match the bare domain, which is why certificates are normally issued naming both in the subject alternative names. One that lists only the wildcard will fail on your apex the first time somebody types the domain without a subdomain in front of it.
Why does a wildcard have to use the DNS challenge?
Because there is no single hostname it could serve a validation file from, so http-01 is unavailable and dns-01 is the only route. That has a lasting consequence: the issuing system needs write access to your zone at every renewal, not just at first issue. Credentials that expire produce a wildcard that issued once and then quietly stopped.
How many sites can one hosting plan run?
From the Turbo tier upwards you can run several, each with its own domain, mailboxes and certificate, all inside a single account. If the additional sites belong to clients rather than to you, reseller hosting is the right shape instead — it keeps each account properly walled off from the others.
Keep reading
Let's Encrypt
The automation that issues it, and why a wildcard can only be validated through DNS.
HTTPS
What runs on top, and the redirect chain worth collapsing once the certificate is in place.
Best Hosting for Wildcard SSL
The same call made as a buyer's guide: what to verify, what to ignore, and the plan we would sign.
Domain Names
Find, register and transfer domains — first year free with annual hosting.
WHMCS License
Automate billing, provisioning and support for your own hosting clients.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Take the certificate out of provisioning.
Free SSL on every plan, several sites per account from Turbo up, and reseller hosting when the sites are somebody else's.
View Domain Names plans