Some links here are affiliate links — if you buy through them we may earn a commission at no extra cost to you. It never changes what we recommend. Full disclosure.
Once a business has more than one hostname — a shop subdomain, a help centre, a second brand, a regional domain — buying one certificate per name stops making sense. Two certificate types exist to fix that: wildcard certificates, which cover every subdomain of one domain, and multi-domain certificates (also sold as SAN or UCC certificates), which cover a specific list of names that can span completely different domains.
They solve different problems, and they're priced very differently. Picking the wrong one usually means paying for coverage you don't use, or discovering at renewal that the one name you needed isn't covered. This guide explains how each works, where each falls short, and how to decide.
The Short Version
| Wildcard | Multi-Domain (SAN / UCC) | |
|---|---|---|
| Covers | *.example.com — every first-level subdomain of one domain | A fixed list of names, which can be on different domains |
| Example | www, shop, blog, app, mail… .example.com | example.com, example.co.uk, shop.otherbrand.com |
| Adding a new name | Automatic — any new first-level subdomain is covered | Reissue the certificate with the new name added |
| Covers different domains | No | Yes |
Covers deeper levels (a.b.example.com) | No | Yes, if listed |
| Available as EV | No | Yes |
| Best for | One domain with many or changing subdomains | Several domains or brands, or a small fixed set of names |
How a Wildcard Certificate Works
A wildcard certificate is issued for *.example.com. The asterisk matches exactly one label, so the certificate is valid for www.example.com, shop.example.com, staging.example.com and any other first-level subdomain you create later, without reissuing anything.
Two limits catch people out:
- One level only.
*.example.comdoes not covereu.shop.example.com. If you need that, you need a separate*.shop.example.comwildcard, or a multi-domain wildcard that lists both. - The bare domain isn't technically matched by the asterisk.
example.comitself isn't a subdomain. Most certificate authorities add it automatically as an extra name, but check the product page before you assume it.
Wildcards are available at the DV and OV levels — for example Comodo PositiveSSL Wildcard, RapidSSL Wildcard, Sectigo OV Wildcard and DigiCert Wildcard SSL. Industry rules don't allow EV wildcards, because EV is meant to tie a certificate to specific, vetted hostnames.
The security trade-off
A wildcard uses one private key for every subdomain it covers. If that key leaks from any one server — a forgotten staging box, a third-party tool you uploaded it to — an attacker can impersonate every subdomain until you revoke and replace it. That's manageable with good key hygiene, but it's a real reason not to put the same wildcard on servers with very different security standards.
How a Multi-Domain (SAN / UCC) Certificate Works
A multi-domain certificate carries a list of names in its Subject Alternative Name (SAN) field. Every name on the list is covered; nothing else is. The names can be on entirely different domains:
example.com,www.example.comexample.co.ukshop.secondbrand.commail.example.com,autodiscover.example.com
Products usually include a base number of names (often three to five) and let you add more up to a limit, commonly 100 to 250. Adding a name later means reissuing the certificate, which is free with most CAs during the certificate's term but does mean installing the new file everywhere the old one was used.
UCC (Unified Communications Certificate) is the same thing under a name that comes from Microsoft Exchange and Office Communications servers, which need several specific hostnames on one certificate. Today "SAN", "UCC" and "multi-domain" are used almost interchangeably.
Multi-domain certificates exist at every validation level, including EV — options include Comodo Multi-Domain SSL, GeoTrust QuickSSL Premium SAN, Sectigo OV SSL Multi-Domain/UCC and DigiCert EV Multi-Domain. If you're not sure which validation level you need, read DV vs OV vs EV SSL Certificates first.
Multi-Domain Wildcard: Both at Once
A multi-domain wildcard certificate lists several wildcard entries (and plain names) on one certificate: *.example.com, *.example.co.uk, *.secondbrand.com. It's the most flexible and the most expensive option, and it's the right one for agencies, SaaS platforms and groups running several brands that each have many subdomains.
Examples: Comodo Multi-Domain Wildcard, GeoTrust True BusinessID Multi-Domain Wildcard and Thawte SSL Web Server Multi-Domain Wildcard.
Which One Should You Buy?
Work through these in order:
- Are all the names on one domain? If yes, and there are more than three or four subdomains — or you add new ones regularly — a wildcard is almost always cheaper and simpler.
- Do the names span different domains or brands? You need a multi-domain certificate (or a multi-domain wildcard if each domain also has many subdomains).
- Do you need EV? Then it's multi-domain EV, listing each hostname. Wildcard is off the table.
- Do the servers have very different owners or security standards? Consider separate certificates, so one compromised server doesn't expose everyone else's hostnames.
- Will names change often? Wildcards absorb new subdomains automatically; multi-domain certificates need a reissue and redeploy each time.
Worked examples
- A content site with
www,blog,shopandhelpsubdomains: a DV wildcard covers everything, including subdomains you haven't created yet. - A business with
brand.com,brand.co.ukandbrand.de: an OV multi-domain certificate with six names (each domain with and withoutwww). - An agency hosting 30 small client sites on one server: separate certificates per client is the cleaner choice — one client leaving doesn't force a reissue for the other 29 — and free automated DV certificates are often enough here.
- A SaaS platform with
*.app.comcustomer subdomains and a marketing site onapp.io: a multi-domain wildcard, or a wildcard plus a separate certificate for the marketing domain.
Cost: What Usually Works Out Cheaper
Rough rules, since exact prices vary by brand and term:
- A wildcard typically costs about as much as five to ten single-domain certificates of the same level. Past three or four subdomains on one domain, it usually wins.
- A multi-domain certificate's price depends on the number of names. For a handful of names across different domains it's usually cheaper than buying each separately, and it's one renewal date instead of several.
- Reissues are typically free during the certificate's term, so adding a SAN costs only the per-name fee, not a whole new certificate.
What Your Certificate Reveals About Your Infrastructure
Every publicly trusted certificate is recorded in public Certificate Transparency (CT) logs, which anyone can search. That has a side effect worth knowing about before you choose:
- A multi-domain certificate lists every name on it. Anyone who opens the certificate, or looks it up in a CT log, sees all the domains and hostnames it covers. If one certificate covers your public site, an unannounced product domain and
vpn.example.com, all three are visible to everyone who visits any of them. - A wildcard reveals only
*.example.com. The names of individual subdomains aren't written into the certificate, which is one reason some organisations prefer wildcards for internal or pre-launch hostnames.
CT logs are a good thing — they let domain owners spot certificates issued without their permission — but it's worth being deliberate. Don't put names on a shared certificate that you wouldn't put on your website, and don't combine unrelated clients' domains on one multi-domain certificate, since each client can see the others.
Installing One Certificate in Several Places
Wildcard and multi-domain certificates usually end up on more than one server. The process is the same as for a single-domain certificate, with a few extra steps:
- Generate one key and CSR on a secure machine. For multi-domain certificates, the CSR's main name (the common name) can be any one of the names; the rest are added during ordering.
- Complete domain validation for every name. A wildcard needs one validation for the base domain, usually by DNS. A multi-domain certificate needs each listed domain validated, so plan for several emails or DNS records.
- Install the full chain — your certificate plus the intermediate certificate the CA provides — on every server. A missing intermediate is the most common cause of "works in Chrome, fails on mobile or in API clients".
- Copy the private key securely, or better, let each server or CDN generate its own key and request its own reissue of the same certificate. Most CAs allow unlimited reissues during the term, so each server can have a separate key under the same order.
- Record every location. A simple table of hostname, server, path and owner is enough. You'll need it at every renewal.
If the certificate sits behind a CDN or load balancer that terminates TLS, you may only need to install it there. Check whether that layer can also handle renewals for you automatically.
Moving From Many Single Certificates to One
Consolidating a pile of separate certificates is often the reason people look at wildcard or multi-domain options in the first place. A safe way to do it:
- Inventory what you have. List every hostname with a certificate, its expiry date and where it's installed. Search CT logs for your domains to catch any you'd forgotten.
- Group the names. Names on one domain go to a wildcard; names across domains that share servers and owners go to a multi-domain certificate; anything with a different owner or security level stays separate.
- Issue the new certificate before the old ones expire, and install it host by host. Visitors don't notice the switch.
- Test each hostname with an external SSL checker to confirm the chain and the names are right.
- Let the old certificates expire (or revoke them if their keys were shared widely) and update your renewal calendar to the single new date.
Consolidation saves money and admin time, but don't over-consolidate: one certificate covering everything means one renewal failure takes everything down.
Wildcards and Multi-Domain on Hosting Platforms
How you buy matters less on modern hosting than it used to, so check what your platform already does:
- Managed WordPress and shared hosts usually issue free certificates for each domain and subdomain you add, automatically. You only need a commercial wildcard if you want OV, a warranty, or coverage the host doesn't automate.
- CDNs often include a free certificate for your domain and its first-level subdomains, and some let you upload your own wildcard or multi-domain certificate on paid plans.
- SaaS platforms with customer subdomains (
customer.yourapp.com) are the classic wildcard use case; platforms that let customers bring their own domains usually issue a certificate per customer domain automatically instead.
Renewals and Automation
Industry rules are steadily shortening how long any public certificate can be valid — see SSL Certificate Lifetimes Are Shrinking. That hits wildcard and multi-domain certificates hardest, because one certificate is installed in many places. Before you buy, know every server, load balancer and CDN the certificate will live on, and make sure each one can be updated automatically or from a single checklist.
Common Mistakes
- Expecting a wildcard to cover two levels deep.
*.example.comdoesn't matcha.b.example.com. - Forgetting the bare domain on a multi-domain certificate — list both
example.comandwww.example.com. - Copying one wildcard key to every vendor and tool that asks for it. Each copy is another place it can leak.
- Choosing multi-domain for a fast-changing set of subdomains, then reissuing every month.
- Trying to buy an EV wildcard. It doesn't exist; use EV multi-domain instead.
Frequently Asked Questions
Does a wildcard cover example.com as well as www.example.com?
Usually yes, because the CA adds the bare domain as an extra name — but check, because the asterisk alone doesn't match it.
Can I add names to a multi-domain certificate later?
Yes. You reissue the certificate with the extra names, pay for any names over the included amount, and reinstall it.
Is a wildcard less secure than separate certificates?
The encryption is the same. The difference is blast radius: one leaked wildcard key affects every subdomain, so protect where it's stored.
Does certificate type affect SEO?
No. Search engines care that every URL serves valid HTTPS, not which kind of certificate provides it.
Bottom Line
One domain with many subdomains: wildcard. Several domains: multi-domain. Several domains each with many subdomains: multi-domain wildcard. Need EV: multi-domain EV. Our product reviews — such as Comodo PositiveSSL Wildcard, GeoTrust QuickSSL Premium SAN and Comodo Multi-Domain Wildcard SSL — cover individual products in more depth.
Printed from seo-serps.com — https://seo-serps.com/online-business/wildcard-vs-multi-domain-ssl-certificates-how-to-choose/ — updated November 5, 2026.