Wildcard certificate

One level, and only one. The asterisk replaces a single label.

Not the apex. A certificate for `*.example.com` does not cover `example.com`, which is why wildcards are normally issued with the apex added explicitly as a second name.

Not deeper levels. Covering `a.b.example.com` requires a separate wildcard for `*.b.example.com`.

The matching rule is the same one the subject alternative name extension uses, and it is not negotiable by configuration.

Proving control of a specific hostname can be done by serving a file at that hostname. There is no hostname corresponding to a wildcard, so that method cannot apply.

Authorities therefore require a DNS-based challenge for wildcards: a token published in a TXT record under the domain, proving control of the zone rather than of one host.

Automating that means giving the renewal process credentials to modify DNS, which is a meaningfully larger permission than writing a file into a web root.

Scoping those credentials — to one record, or one subdomain — is worth the configuration effort, because they are effectively control of the domain.

A wildcard is convenient: new subdomains work immediately with no certificate work at all.

It is also a single key valid for everything at that level. A server compromised while holding it can present a valid certificate for any subdomain, including ones it has no business serving.

A certificate listing names explicitly limits the blast radius and makes the inventory visible, at the cost of reissuing when the list changes.

Certificate Transparency also differs: explicitly named certificates publish the subdomain names, a wildcard does not — which some operators treat as a privacy advantage and others as reduced visibility.

Read the subject alternative name list. A wildcard appears as an entry beginning with an asterisk.

Confirm the apex is listed separately if the site serves there. This is the single most common wildcard mistake.

Test a two-level name if you use one. It will fail against a single-level wildcard, and the failure is a browser warning rather than anything subtle.

Check where the key is deployed. A wildcard key on a host that only needs one name is an unnecessary exposure that is easy to correct.