{"id":9655,"date":"2024-08-01T12:06:05","date_gmt":"2024-08-01T10:06:05","guid":{"rendered":"https:\/\/tremhost.com\/blog\/?p=9655"},"modified":"2026-11-05T17:57:27","modified_gmt":"2026-11-05T15:57:27","slug":"multi-domain-wildcard-ssl","status":"publish","type":"post","link":"https:\/\/tremhost.com\/blog\/multi-domain-wildcard-ssl\/","title":{"rendered":"Multi-Domain Wildcard SSL: When You Need One"},"content":{"rendered":"<p>A multi-domain wildcard SSL certificate secures several different domain names and all the first-level subdomains of each, in one certificate. You need one when you run, for example, yourbrand.com and yourbrand.co.zw, each with shop., mail. and portal. subdomains, and want a single certificate to buy, validate and renew. If you only have one domain, a standard wildcard is simpler, and if your site is on Tremhost hosting, free SSL may already be all you need.<\/p>\n<h2>What happened to Symantec Secure Site Pro?<\/h2>\n<p>Symantec&#8217;s website certificate business was acquired by DigiCert in 2017, and browsers subsequently stopped trusting certificates issued under the old Symantec infrastructure. Certificates once sold under the Symantec name, including the Secure Site range, are now sold under the DigiCert brand. If you are looking for a &#8220;Symantec Secure Site Pro Multi-Domain Wildcard&#8221;, the current equivalent is a DigiCert multi-domain certificate with wildcard names, or a comparable certificate from another authority.<\/p>\n<h2>How SSL certificates differ<\/h2>\n<p>Every SSL certificate encrypts traffic between the visitor&#8217;s browser and your server in the same way. Certificates differ in two things: how much the certificate authority checks before issuing, and how many names the certificate covers.<\/p>\n<h3>Validation level<\/h3>\n<ul>\n<li><strong>Domain Validated (DV):<\/strong> proves you control the domain. Usually issued in minutes.<\/li>\n<li><strong>Organisation Validated (OV):<\/strong> also checks that your organisation is real and registered, and puts the company name in the certificate details. Usually takes a couple of days.<\/li>\n<li><strong>Extended Validation (EV):<\/strong> the most thorough vetting. Industry rules do not allow wildcard names on EV certificates, so a multi-domain wildcard will be DV or OV.<\/li>\n<\/ul>\n<h3>Coverage<\/h3>\n<ul>\n<li><strong>Single domain:<\/strong> one name, such as www.example.com (most also cover example.com).<\/li>\n<li><strong>Wildcard:<\/strong> one domain and all first-level subdomains, written *.example.com.<\/li>\n<li><strong>Multi-domain (SAN or UCC):<\/strong> several different names in one certificate.<\/li>\n<li><strong>Multi-domain wildcard:<\/strong> several names, any of which can be a wildcard, such as *.example.com and *.example.co.zw.<\/li>\n<\/ul>\n<h2>When a multi-domain wildcard makes sense<\/h2>\n<ul>\n<li>You run the same brand on several domains, such as a .com and a .co.zw, each with subdomains.<\/li>\n<li>Your subdomains change often, so naming each in advance is impractical.<\/li>\n<li>You want one renewal date and one validation process instead of many.<\/li>\n<li>Your servers or load balancers need one certificate to present for many names.<\/li>\n<\/ul>\n<h3>When it does not<\/h3>\n<ul>\n<li>One domain with a few subdomains: a single-domain wildcard is enough.<\/li>\n<li>Several domains without subdomains: an ordinary multi-domain certificate is cheaper.<\/li>\n<li>A site on hosting that includes free SSL: free certificates already provide the same encryption.<\/li>\n<\/ul>\n<h2>Wildcard limits to know<\/h2>\n<p>A wildcard covers one level only. *.example.com covers shop.example.com but not test.shop.example.com, which needs its own name or a separate wildcard. Using one certificate everywhere also means one private key in many places, so if a server holding the key is compromised, every name on the certificate is affected. Keep the key on as few systems as you can, and reissue the certificate if you suspect a leak.<\/p>\n<h2>Free SSL or paid?<\/h2>\n<p>Free certificates, such as those included with Tremhost hosting, give the same encryption strength as paid DV certificates and renew automatically. Paid certificates make sense when you need organisation validation, a warranty, a site seal, a certificate for a server outside your hosting, or wildcard and multi-domain coverage managed in one place.<\/p>\n<h2>Renewals and reissues<\/h2>\n<p>Industry rules agreed by browsers and certificate authorities are shortening the maximum lifetime of SSL certificates in stages from 2026. In practice, a certificate bought for a year may need to be reissued and reinstalled one or more times during that year. Before you buy, ask how reissues are handled and whether installation of each reissue is included. Automation matters more as lifetimes shorten, so prefer setups where the renewal and installation can be scripted or handled by your host. Keep a list of every server and service that uses the certificate, so nothing is missed when it changes.<\/p>\n<h2>What Tremhost offers<\/h2>\n<p>Tremhost sells DV, OV, EV, wildcard and multi-domain certificates from DigiCert, Sectigo, GeoTrust, RapidSSL and Thawte, and installs them free when your site runs on Tremhost hosting, a VPS or a dedicated server. Prices on the SSL page include:<\/p>\n<ul>\n<li><strong>RapidSSL (DV, one domain):<\/strong> $40 a year.<\/li>\n<li><strong>Thawte SSL Web Server (OV, one domain):<\/strong> $123 a year.<\/li>\n<li><strong>EssentialSSL Wildcard (DV wildcard):<\/strong> $164 a year.<\/li>\n<li><strong>RapidSSL Wildcard (DV wildcard):<\/strong> $175 a year.<\/li>\n<\/ul>\n<p>Multi-domain, EV and premium DigiCert certificates are listed in the Tremhost store; check the current price there. Payment can be made by EcoCash, InnBucks, ZimSwitch, Omari, Visa, Mastercard or selected cryptocurrencies.<\/p>\n<h2>How to order and install<\/h2>\n<ol>\n<li>List every domain and subdomain you need to cover, and decide which should be wildcards.<\/li>\n<li>Choose DV or OV depending on whether your organisation needs to appear in the certificate.<\/li>\n<li>Generate a certificate signing request (CSR) on your server, or ask Tremhost to do it if you host with them.<\/li>\n<li>Complete validation for each domain, usually by email, DNS record or a file on your server.<\/li>\n<li>Install the certificate and intermediate chain, then test each name in a browser.<\/li>\n<\/ol>\n<p>For the free certificate on Tremhost hosting, follow the guide to <a href=\"https:\/\/tremhost.com\/help\/install-free-ssl\">installing free SSL<\/a>.<\/p>\n<h2>Frequently asked questions<\/h2>\n<h3>Can I still buy a Symantec certificate?<\/h3>\n<p>Not under that name. The business is now DigiCert, which sells the equivalent products under its own brand.<\/p>\n<h3>Does a wildcard cover the bare domain?<\/h3>\n<p>Most authorities include the bare domain, such as example.com, alongside *.example.com. Check the product details before buying.<\/p>\n<h3>Can an EV certificate include wildcards?<\/h3>\n<p>No. Wildcard names are only available on DV and OV certificates.<\/p>\n<h3>Is a paid certificate more secure than free SSL?<\/h3>\n<p>The encryption is the same. Paid certificates add validation of your organisation, coverage options and, depending on the product, a warranty and site seal.<\/p>\n<h2>Next step<\/h2>\n<p>Compare certificates and use the wildcard calculator on the <a href=\"https:\/\/tremhost.com\/ssl\">Tremhost SSL certificates page<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>What a multi-domain wildcard SSL certificate covers, when it is worth buying, what replaced Symantec Secure Site Pro, and how to order one.<\/p>\n","protected":false},"author":226,"featured_media":9656,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[24,2],"tags":[],"class_list":["post-9655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ssl","category-tremhost"],"_links":{"self":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts\/9655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/users\/226"}],"replies":[{"embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/comments?post=9655"}],"version-history":[{"count":6,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts\/9655\/revisions"}],"predecessor-version":[{"id":81097,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts\/9655\/revisions\/81097"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/media\/9656"}],"wp:attachment":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/media?parent=9655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/categories?post=9655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/tags?post=9655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}