Wildcard or multi-domain certificate — which do I actually need?

Wildcard or multi-domain certificate — which do I actually need?

When does *.example.com save you, and when does it quietly fail? The choice hinges on one detail of how wildcards match, which beginners routinely get wrong.

A wildcard certificate covers exactly one label of subdomain depth. *.example.com matches www.example.com and api.example.com, but it does not match:

— example.com itself (the bare apex — you must add it explicitly to the Subject Alternative Name list)
— a.b.example.com (two labels deep — the wildcard only covers one)

This single-label rule comes straight from RFC 6125 and the CA/Browser Forum Baseline Requirements, which forbid wildcards in any position but the leftmost.

A multi-domain (SAN) certificate instead enumerates each name explicitly: example.com, shop.example.org, blog.net — even across different registrable domains. More flexible, but every name is fixed at issuance; adding one means reissuing.

Practical guidance: use a wildcard when you spin up many same-level subdomains dynamically and don't want to reissue each time. Use SAN when you have a known, stable set of distinct hostnames. Note that wildcards require DNS-01 validation with Let's Encrypt (HTTP-01 cannot prove control of *).

Further reading: RFC 6125; CA/Browser Forum Baseline Requirements section 3.2.2.6.

Bottom line: wildcard = one subdomain level, apex excluded. SAN = a fixed explicit list. Match the cert to how your hostnames grow.