What is a wildcard SSL certificate?

A wildcard SSL certificate is issued for a name such as *.example.com and covers every single-level subdomain of that domain, for example www.example.com and shop.example.com, with one certificate.

What does a wildcard certificate not cover?

The bare domain example.com is not covered unless it is listed as a second name, and neither are subdomains of subdomains such as a.shop.example.com. Always check the list of names on the certificate.

How is it validated?

Most authorities require proof that you control the whole domain, usually through a DNS record. Let's Encrypt, for example, issues wildcard certificates only with DNS validation, so a changed DNS provider or a removed record can break renewal.

Should I use one for client sites?

A wildcard is convenient for many subdomains of one client, but it concentrates risk: one expired or leaked certificate affects all of them. Track its expiry as carefully as the main one. The certificate checker lists the names a certificate covers.

Where Datumboard fits

Datumboard puts the signals behind this in one dashboard for your client sites and side projects. It is in early access, and you can join the list below.