A single-domain SSL certificate secures one website name, usually with its www version. A wildcard certificate secures every first-level subdomain of a domain with one certificate. On Domain India hosting you often need neither as a separate purchase: the free certificates that come with hosting already cover your domain, www and each subdomain by name.
A single-domain certificate covers one name, usually example.com plus www.example.com. A wildcard (*.example.com) covers any first-level subdomain, such as shop.example.com, but not a.b.example.com and not another domain. For most sites a normal certificate that lists each subdomain by name works just as well, and on Domain India hosting the free certificate does exactly that. Consider a wildcard only when you create many subdomains on the fly; ask support before you set one up.
1. What a single-domain certificate covers
A single-domain certificate is issued for one fully qualified name, such as www.example.com. Almost every certificate authority also adds the bare domain example.com as a second name (a Subject Alternative Name, or SAN), so both addresses work. Check the certificate details if you are unsure.
It does not cover shop.example.com, mail.example.com or any other subdomain unless that name is added to the certificate too. That is where many people think they need a wildcard. In practice, most certificates today can list several names, so one certificate for example.com, www, shop and blog is normal.
2. What a wildcard certificate covers
A wildcard certificate is issued for *.example.com. The asterisk matches exactly one label, so:
| Name | Covered by *.example.com? |
|---|---|
| www.example.com | Yes |
| shop.example.com | Yes |
| mail.example.com | Yes |
| example.com (no subdomain) | Only if the certificate also lists it; most do |
| blog.shop.example.com | No, that is two levels |
| example.net | No, that is a different domain |
For a deeper level such as *.shop.example.com, you need a separate wildcard for that level or a certificate that names the subdomain.
3. Side-by-side comparison
| Feature | Single-domain (or multi-name) | Wildcard |
|---|---|---|
| Coverage | The names listed on the certificate | Any first-level subdomain, plus usually the bare domain |
| New subdomains | Need the certificate reissued with the new name | Covered automatically |
| Validation types | DV, OV and EV | DV and OV only; EV wildcards are not allowed |
| How ownership is proved | A file on the website, an email or DNS | Usually a DNS record; Let's Encrypt wildcards need DNS validation |
| If the private key leaks | Only the listed names are exposed | Every subdomain is exposed |
| Typical cost for paid certificates | Lower | Higher |
4. Security trade-offs
A wildcard is convenient, but one key protects everything under the domain.
- One key, many servers. If you install the same wildcard on your website, a third-party shop platform and a staging server, a leak on any of them exposes all your subdomains.
- Separate what matters. Give a payment or login subdomain its own certificate, even if the rest of the site uses a wildcard.
- Keep the key private. Neither a certificate authority nor Domain India support ever needs your private key. If it has been emailed or pasted into a chat, generate a new key and have the certificate reissued.
5. Multi-domain (SAN) certificates
If you need to secure different domains, such as example.com, example.in and anotherbrand.com, a wildcard can't help: it covers subdomains of one domain only. A multi-domain (SAN) certificate lists several different domains on one certificate. Free Let's Encrypt certificates work the same way and can list up to 100 names each.
Certificate lifetimes are also getting shorter. Industry rules cut the maximum life of a publicly trusted certificate to 200 days from March 2026, with further cuts planned to 47 days by 2029. Automatic renewal therefore matters more than which type you buy.
6. How it works on Domain India hosting
| Hosting | Free certificate | Subdomains | Wildcard |
|---|---|---|---|
| cPanel | Let's Encrypt, issued and renewed by AutoSSL | Each domain, www, addon domain, subdomain and service names such as mail, listed by name | AutoSSL does not issue wildcards; ask support |
| DirectAdmin | Let's Encrypt, issued automatically | Your domain and www, and names such as mail can be added | Needs DNS validation; ask support before you try |
| Windows (Plesk) | Let's Encrypt, installed from the panel | Choose the names when you install it; see the Plesk SSL guide | Ask support |
A name is covered only when its DNS points to your hosting server. On cPanel, AutoSSL checks every few hours and adds new subdomains on its next run. You can see which names are covered on the Status tab of Security › SSL/TLS Certificates; if a new subdomain is urgent, support can run AutoSSL for you. On DirectAdmin, the certificate renews automatically before it expires.
If your subdomains all live on your Domain India hosting, the free certificate already secures each one by name at no cost. A wildcard mainly helps when subdomains are created automatically, for example one per customer in a SaaS app, or when the same certificate must be installed on servers outside your hosting.
If a bank, tender or partner specifically requires a paid, wildcard or organisation-validated certificate, open a ticket with the domain and the requirement and support will advise you. You can also buy a certificate from any certificate authority and install it on your hosting yourself; see how to generate a CSR.
7. Which one should you choose?
8. Troubleshooting
| Problem | Likely cause | Fix |
|---|---|---|
| The bare domain shows a certificate warning with a wildcard | The certificate lists only *.example.com | Reissue it with example.com added as a name |
| A two-level subdomain isn't secure | Wildcards cover one level only | Add the name to a certificate, or get a wildcard for that level |
| A new subdomain has no certificate on cPanel | AutoSSL hasn't run since you added it, or DNS doesn't point to us yet | Check DNS, then wait for the next AutoSSL run |
| Free certificate never issued | The name doesn't point to your hosting, a CAA record blocks Let's Encrypt, or a proxy answers first | Fix DNS, then request it again |
What is the difference between wildcard and single-domain SSL?
A single-domain certificate covers the names listed on it, usually example.com and www.example.com. A wildcard certificate for *.example.com covers any first-level subdomain, such as shop.example.com, but not deeper levels or other domains.
Does a wildcard certificate cover the main domain?
Only if the bare domain is also listed on the certificate. Most certificate authorities include it, but check before you install it.
Does a wildcard cover sub.blog.example.com?
No. A wildcard matches exactly one level. You need a wildcard for *.blog.example.com or a certificate that names that subdomain.
Can I get an EV wildcard certificate?
No. Industry rules do not allow extended validation wildcard certificates. Use DV or OV for a wildcard, or separate EV certificates for specific names.
Does Domain India's free SSL cover my subdomains?
Yes, by name. On cPanel, AutoSSL covers the domain, www, addon domains, subdomains and service names such as mail when they point to your hosting. On DirectAdmin you choose the names when you request the free certificate.
Can I get a free wildcard certificate on Domain India hosting?
AutoSSL on cPanel does not issue wildcards, and a Let's Encrypt wildcard needs DNS validation, which depends on where your DNS is hosted. Ask support before you try; for most sites, listing each subdomain works just as well.
Is a wildcard less secure?
The encryption is the same, but one private key protects every subdomain, so a leak on any server using it exposes them all. Keep the key private and give sensitive subdomains their own certificate.
Ready to secure your site? Check your certificates from My hosting, read AutoSSL in cPanel, free SSL in DirectAdmin or installing SSL in Plesk, or open a ticket if you think you need a wildcard. Support is on 24/7 live chat, and tickets get a first response within 15 minutes.
Tell us your domain and the subdomains you use, and we will tell you whether the free certificate already covers them.
Ask support