Wildcard SSL: every subdomain, one certificate

A wildcard SSL certificate from CloudHosting has an asterisk in its name, for example *.example.com, so one certificate secures every direct subdomain of the domain: www, mail, shop, api and any other. The main advantage shows as the site grows: a subdomain created later is covered automatically as soon as its DNS resolves, with no reissue and no new order. When you order, the CSR is generated with the asterisk name, and you use the issued bundle across all your services. Instead of keeping a separate certificate with its own expiry date for every subdomain, you track a single renewal date.

At CloudHosting wildcard SSL starts at 83.04 EUR a year without VAT for Sectigo PositiveSSL Wildcard, a DV certificate that fits most sites; that is the average yearly price on the longest term, and shorter terms cost more per year. RapidSSL, GeoTrust and Thawte DV wildcards cost more, and the OV brands GeoTrust TrueBusinessID and DigiCert are priced higher still, because the CA also vets the company behind the domain. Latvian VAT of 21% applies where relevant. The amount in the catalog is the full cost for the chosen term, paid once. Brands differ in validation depth and warranty, so paying more mainly makes sense when your customers expect a vetted company name in the certificate.

On every brand CloudHosting sells, a wildcard certificate includes both *.example.com and the bare example.com, so the apex domain is secured without extra entries or a second certificate. In practice a visitor who types example.com without any subdomain still gets a valid HTTPS connection from the same certificate that protects www, mail or shop. You do not have to configure anything special: the apex entry is part of the issued certificate itself, and you can verify it in the browser after issuance. This applies to every wildcard in our catalog: Sectigo, RapidSSL, GeoTrust, Thawte and DigiCert.

A wildcard certificate from CloudHosting, like any wildcard, matches exactly one label: shop.example.com and api.example.com are covered, but a.b.example.com is not, because it sits one level deeper. To secure that name you need a separate wildcard for *.b.example.com or a multi-domain certificate with the exact hostname added as a SAN entry. In practice it pays to plan your naming early: if everything lives directly under the main domain, one wildcard is enough, while deep structures multiply certificates and administration. If you are unsure which layout fits your case, write to support and describe the hostnames you plan to use.

CloudHosting sets no limit on servers: you can install the same wildcard certificate and private key on every web, mail or API server that serves a subdomain, at no extra cost per server. This matters when one domain is spread across several machines, for example a website on one server and mail on another: they can all present the same wildcard. Keep the private key protected on each machine, and remember that every copy must be replaced when the certificate is reissued, so keep a simple list of everywhere it is installed, or let the free chssl agent handle the replacement on each Linux server.

CloudHosting does not sell EV wildcards because no certificate authority issues them: CA/B Forum rules do not allow extended validation to be combined with a wildcard name. The strongest validation available for a wildcard is OV, for example GeoTrust TrueBusinessID Wildcard or DigiCert Wildcard SSL, where the CA vets the company behind the domain and includes it in the certificate. For most sites this is sufficient: encryption strength is the same across validation levels, the difference is how thoroughly the owner is checked. If a policy in your organization strictly requires EV, it can only be applied to certificates that list exact hostnames rather than an asterisk.

CloudHosting DV wildcards such as Sectigo PositiveSSL and RapidSSL are issued within minutes once domain validation is complete, and there is only one check for the whole domain: you either add a DNS record or confirm a link sent to an email address on that domain. The real waiting time is usually on your side, for example waiting for a DNS change to propagate. OV brands like GeoTrust TrueBusinessID and DigiCert additionally vet the company behind the order, a step that cannot be fully automated, so issuance takes noticeably longer; order OV certificates ahead of any deadline. If validation gets stuck, write to support and we will help you through it.

CloudHosting sells both, and the choice depends on your names: a wildcard covers an unlimited number of subdomains of one domain, including ones you create later, while a SAN, or multi-domain, certificate puts up to 250 hostnames from different domains on one certificate. Choose a wildcard when everything sits under one domain; choose SAN when several different domains, for example separate sites on different names, need to share a certificate. The two approaches can be combined: multi-domain certificates can carry wildcard SAN entries, so one certificate covers several domains and all their subdomains at once. List every hostname you serve today and expect to add; if unsure, send the list to support.

A single-domain certificate from CloudHosting covers one hostname together with www and costs less, so if you serve only www.example.com there is no reason to pay for a wildcard. As soon as you run mail, shop, api or staging alongside the main site, separate certificates mean separate orders, separate validations and separate renewal dates to track. One wildcard from 83.04 EUR a year replaces all of that with a single certificate and a single renewal, and any subdomain you add later is covered automatically. It is not always cheaper than a few budget certificates, but it is always simpler to administer, and its advantage grows with the number of subdomains.

CloudHosting delivers every wildcard term of 1 to 5 years as consecutive certificates, because a public certificate is now valid for up to 199 days under CA/B Forum rules. Each reissue within your paid term is free: you start it in the client panel, which shows how many days are left, and then replace the file on every server that uses the wildcard. That last step needs care, since one wildcard often lives on several machines. Our free chssl agent for Linux servers with nginx, Apache or Docker finds the certificate on each server, installs the new file and reloads the web server automatically, so install it on every machine that holds a copy.