Does a wildcard SSL certificate cover the root domain?

Not automatically. A certificate for *.example.com covers sub.example.com but not example.com itself. Most CAs include both the wildcard and root domain as SANs, but you should verify.

Can a wildcard SSL cover multiple subdomain levels?

No. *.example.com only covers one level (e.g., app.example.com). It does not cover deep subdomains like staging.app.example.com. You need a separate certificate for those.

How do I get a free wildcard SSL certificate?

Let's Encrypt issues free wildcard certificates via DNS-01 challenge. You need to create a TXT record (_acme-challenge.example.com) to prove domain ownership.

Wildcard SSL Certificates — Setup and Pitfalls

Learn how wildcard SSL certificates work, when to use them, and common mistakes to avoid.

Diagnose your site now

Problem

You want to secure multiple subdomains with a single SSL certificate but aren’t sure how wildcard certificates work or if they’ll cover your use case.

How Wildcard SSL Works

A wildcard certificate for *.example.com secures one level of subdomains.
Covered: www.example.com, api.example.com, app.example.com
Not covered: example.com (root), staging.api.example.com (two levels)

Top 3 Pitfalls

Assuming root domain is covered — Always check the SAN list. Most CAs include example.com + *.example.com, but some don’t.
Multi-level subdomains — *.example.com does NOT match a.b.example.com. You need a separate cert or multi-SAN certificate.
DNS-01 challenge automation — Wildcard certs from Let’s Encrypt require DNS-01 validation. If your DNS provider doesn’t support API-based TXT record updates, auto-renewal will fail.

Diagnosis with DechoNet

SSL Check — Verify the certificate’s SAN list to confirm which domains are covered.
DNS Lookup — Check if _acme-challenge TXT records exist for Let’s Encrypt validation.

Resolution Checklist

Confirm the wildcard cert covers both *.example.com and example.com in the SAN list.
For multi-level subdomains, issue a separate certificate or use a multi-SAN cert.
Automate DNS-01 challenge with your DNS provider’s API (Cloudflare, Route53, etc.).
Set up auto-renewal with certbot or ACME client and test with --dry-run.
After installation, verify the full chain with DechoNet SSL Check.