A Wildcard SSL certificate protects all subdomains of a domain with a single certificate. Its name refers to the asterisk character (wildcard, a character that acts as a substitute): the certificate is issued for the name *.pelda.hu, and the * can be replaced by any subdomain, such as shop.pelda.hu, mail.pelda.hu or a subdomain created at a later date, such as teszt.pelda.hu.

What does it protect, and what does it not protect?

The *.pelda.hu certificate is valid:

• all subdomains of the domain that are one level lower: www.pelda.hu, shop.pelda.hu, api.pelda.hu;
• including subdomains created at a later date, without the need for reissuance;
• The base domain pelda.hu, provided the certificate covers it. Our wildcard certificate also protects the base domain.

Invalid:

• For second-level subdomains: the *.pelda.hu certificate does not cover the teszt.shop.pelda.hu address. A separate *.shop.pelda.hu certificate is required for this; a ‘double’ wildcard (*.*.pelda.hu) does not exist;
• For other domains: to protect pelda.com or masikceg.hu, you will need a separate certificate or a multi-domain certificate.

Wildcard certificates are only available at the Domain Validated (DV) or Organisation Validated (OV) levels; Extended Validation (EV) wildcard certificates are not permitted under the regulations.

Wildcard or SAN?

• Wildcard: if you have many subdomains, or regularly create new ones (for example, per client, per online shop or per development environment), and do not wish to reissue the certificate for every new subdomain.
• Multi-domain (SAN) certificate: if you wish to secure different domains, or if you only need a few pre-defined subdomains.

How can this be validated?

With a Wildcard certificate, the certificate authority verifies control over the base domain. As the rules do not permit the issuance of a Wildcard certificate via the placement of a validation file (HTTP validation), validation is carried out via a DNS record or by email. DNS validation requires access to the domain’s DNS zone, whilst email validation requires a designated email address (for example, admin@pelda.hu).

Let’s Encrypt also issues free wildcard certificates, but only with DNS validation; see: Wildcard Let’s Encrypt certificate with DNS validation.

What should you look out for?

• Protecting your private key. If you install the same Wildcard certificate on multiple servers (web server, mail server, load balancer), the private key will also be installed on all servers. If it is compromised on any one of them, all subdomains will be affected, and the certificate will need to be replaced everywhere. For sensitive systems, it is therefore advisable to use a separate certificate.
• Reissuance on all servers. Since 15 March 2026, a certificate is valid for a maximum of 200 days, so it must be reissued at least once during the annual subscription period. The new certificate must be installed on every server where the old one was in use.
• Less public data. Certificates are recorded in the public Certificate Transparency logs. In the case of wildcard certificates, only *.pelda.hu appears in these logs, so the names of individual subdomains are not revealed.
• Email and other services. The Wildcard certificate can also be used to secure mail servers (mail.pelda.hu) and other services, provided the software supports it; most modern mail and web servers do.

Wildcard SSL at aWh

Our Wildcard SSL certificate is valid for the base domain (pelda.hu) and an unlimited number of its top-level subdomains (*.pelda.hu); with domain validation, we usually issue it within minutes. You can find the price and a comparison with other certificate types on the SSL certificates page.