A wildcard SSL certificate secures your main domain and all its subdomains with a single certificate. To install one, you need to purchase a wildcard certificate, generate a Certificate Signing Request (CSR) for your domain using *.yourdomain.com as the common name, complete domain validation, and then install the issued certificate files on your server through your hosting control panel.
Installing a wildcard SSL is straightforward once you understand the basic steps, and it saves you from managing separate certificates for each subdomain like mail.yourdomain.com, blog.yourdomain.com, or shop.yourdomain.com.
What Is a Wildcard SSL Certificate
A wildcard SSL certificate uses an asterisk (*) in the domain name to cover unlimited first-level subdomains. For example, a certificate for *.example.com will secure www.example.com, mail.example.com, store.example.com, and any other subdomain you create. The main domain (example.com) can also be included depending on how the certificate is issued.
This type of certificate is ideal when you operate multiple services under one domain or plan to add new subdomains regularly without purchasing additional SSL certificates.
Step-by-Step Installation Process
Step 1: Purchase Your Wildcard SSL Certificate
Order a wildcard SSL certificate from your hosting provider or certificate authority. At OBHost, wildcard certificates are available through your client area. Make sure you select the wildcard option during purchase, as standard SSL certificates only cover a single domain or specific subdomains.
Step 2: Generate a Certificate Signing Request
Log into your VPS control panel or server management interface. Navigate to the SSL/TLS section and find the option to generate a new CSR. When creating the CSR, enter your domain in wildcard format as *.yourdomain.com for the common name field. Fill in your organization details accurately, as these will be verified during the validation process.
Save both the generated CSR and the private key in a secure location. You will need the CSR to request the certificate and the private key during installation.
Step 3: Submit CSR and Complete Domain Validation
Submit your CSR through your certificate provider's system. You will need to complete domain validation to prove you own the domain. Common validation methods include email validation (receiving a confirmation email at admin@yourdomain.com or similar addresses), DNS validation (adding a specific TXT record to your DNS zone), or HTTP file validation (uploading a verification file to your web server).
DNS validation is often preferred for wildcard certificates as it works regardless of your email configuration. Follow the provided instructions to add the required DNS record through your domain's DNS management panel.
Step 4: Download Certificate Files
Once validation completes, download your certificate files. You typically receive a certificate file (CRT), an intermediate certificate (CA bundle), and you already have your private key from Step 2. Keep all these files organized and secure.
Step 5: Install the Certificate on Your Server
For cPanel users, go to SSL/TLS in your control panel, select Manage SSL Sites, choose your domain, and paste the certificate, private key, and CA bundle into their respective fields. Click Install Certificate to complete the process.
For VPS or dedicated server users, the installation method depends on your web server software. For Apache, you typically edit your virtual host configuration file to point to the certificate files using SSLCertificateFile, SSLCertificateKeyFile, and SSLCertificateChainFile directives. For Nginx, you combine the certificate and CA bundle into one file and reference it with ssl_certificate, while the private key uses ssl_certificate_key.
After updating configuration files, test your configuration syntax and restart your web server to apply changes.
Step 6: Verify Installation Across Subdomains
Test your wildcard certificate by visiting different subdomains using https:// in your browser. Check that each subdomain shows the secure padlock icon and that the certificate details display your wildcard domain. Use online SSL checker tools to verify proper installation and identify any chain or configuration issues.
Common Configuration Tips
Make sure all your subdomains point to the correct server IP address through DNS A records. The wildcard certificate only handles encryption, not routing. If a subdomain does not resolve to your server, visitors cannot reach it even with a valid certificate.
Configure your web server to redirect HTTP traffic to HTTPS for all subdomains. This ensures visitors always use the encrypted connection. Most control panels offer automatic redirection options, or you can add redirect rules to your server configuration.
Set up automatic renewal reminders before your certificate expires. Wildcard certificates typically last one year, and letting them expire will break HTTPS for all your subdomains simultaneously. Many hosting providers, including OBHost, offer automatic renewal options for SSL certificates.
Frequently Asked Questions
Does a wildcard SSL certificate cover the main domain too?
A wildcard certificate for *.example.com covers first-level subdomains like www.example.com and mail.example.com, but may not automatically cover the bare domain example.com. Many certificate providers include the main domain as a Subject Alternative Name (SAN), so verify this when purchasing. If not included, you may need to create a redirect from example.com to www.example.com or purchase a certificate that explicitly lists both.
Can I use one wildcard certificate across multiple servers?
Yes, you can install the same wildcard certificate on multiple servers as long as they serve subdomains of the same domain. Simply copy the certificate files and private key to each server and install them following the same process. This is useful when you have a distributed infrastructure or multiple VPS instances handling different subdomains.
Will a wildcard certificate secure multi-level subdomains?
No, a standard wildcard certificate for *.example.com only covers one level of subdomains. It secures shop.example.com but not products.shop.example.com. To secure multi-level subdomains, you need either a multi-level wildcard certificate (*.*.example.com) if available from your provider, or you need to list specific multi-level subdomains as SANs on a multi-domain certificate.
How do I renew a wildcard SSL certificate?
Renewal follows the same process as initial installation. Generate a new CSR using the wildcard domain format, submit it to your certificate provider, complete domain validation again, download the new certificate files, and install them on your server. Schedule this process at least two weeks before expiration to avoid any service interruption. Some providers offer automated renewal systems that handle CSR generation and installation automatically.
If you need assistance installing your wildcard SSL certificate or have questions about securing your subdomains, our support team is available 24/7 to help. Visit our contact page or email support@obhost.org for technical support.
