SSL Certificates for Subdomains: Wildcard vs. Multi-Domain Options
Every subdomain that serves content over HTTPS needs an SSL/TLS certificate that covers that specific hostname. A certificate issued for www.example.com will not work for blog.example.com or api.example.com — modern browsers will display security warnings to visitors accessing a subdomain with a mismatched or missing certificate. As organizations deploy more subdomains for different purposes, certificate management becomes a meaningful operational challenge. Understanding the certificate types available and their trade-offs allows you to choose a strategy that is both cost-effective and maintainable.
Single-Domain Certificates: Simple but Limited
A single-domain SSL certificate covers exactly one hostname — for example, www.example.com. It cannot cover any other domain or subdomain. These certificates are the simplest to issue and manage, and free options from Let's Encrypt make them essentially zero-cost for any individual subdomain. The drawback is operational: if you have ten subdomains, you have ten certificates to obtain, install, renew, and monitor. Each Let's Encrypt certificate expires after 90 days, so automated renewal is essential. For a small, stable set of subdomains where each runs on a different server with different ownership, individual certificates can be the right answer. For organizations managing many subdomains centrally, a broader certificate type is far more practical.
Wildcard Certificates: One Certificate for All Subdomains
A wildcard certificate is issued for *.example.com and covers every single-level subdomain of example.com — www, blog, api, staging, and any new subdomain you add in the future — with a single certificate. This dramatically simplifies certificate management when you are deploying many subdomains. Wildcard certificates can be obtained from commercial certificate authorities or from Let's Encrypt (which requires DNS-01 challenge validation rather than the simpler HTTP-01 method). The key limitation is that wildcard certificates only cover one subdomain level: *.example.com covers blog.example.com but not deep.blog.example.com. Each organization also needs to manage the private key carefully since one compromised key exposes all subdomains simultaneously.
Multi-Domain SAN Certificates
A Subject Alternative Name (SAN) certificate, sometimes called a multi-domain certificate, lists multiple specific hostnames that the certificate covers in its SAN field. A single SAN certificate might cover example.com, www.example.com, blog.example.com, shop.example.com, and even an entirely different domain like example.net. Commercial certificate authorities typically allow 100 or more SANs per certificate. SAN certificates are ideal when you need coverage across multiple distinct domains and a carefully controlled list of specific subdomains. They are also the right choice when you need coverage at the root domain apex and specific subdomains together — a wildcard does not automatically cover the root domain, requiring either a SAN entry or a separate certificate for example.com itself.
Automating Certificate Management with ACME
The ACME protocol, originally developed for Let's Encrypt, automates certificate issuance and renewal. Tools like Certbot, acme.sh, and Caddy web server's built-in ACME client can automatically obtain, install, and renew certificates without human intervention. For wildcard certificates from Let's Encrypt, ACME DNS-01 validation requires your ACME client to have API access to your DNS provider to create temporary TXT records during issuance. Most major DNS providers offer APIs that Certbot plugins support, making automated wildcard certificate renewal achievable with a single configuration effort. Setting up automated certificate management before you encounter a certificate expiration in production prevents the user-trust and SEO damage that expired certificates cause. Explore subdomain SSL strategies at SubDoms or contact us for configuration guidance.