The key point
*.example.com covers one subdomain level. The bare domain and deeper subdomains need their own matching SAN entries.
What it covers
*.example.com matches first-level names such as app.example.com and mail.example.com. It does not match the bare example.com or deeper a.b.example.com. Some products include the base domain separately. Confirm both product coverage and the issued SAN list.
Validation constraint
File-based validation is not available for wildcard coverage. Choose a DNS or approver-email method offered in setup and follow the exact CA challenge for the authorised domain.
DV or OV only
Public EV wildcard certificates are not offered here. For EV across several hostnames, list the exact names in an appropriate EV multi-domain product. Adding a deeper wildcard also requires a product and order scope that support it.
Worked example
Does *.example.com cover this address?
The asterisk replaces one complete label. Decide coverage from the certificate names, not from how your website redirects or where its files are hosted.
- shop.example.com
- Covered by *.example.com.
- api.example.com
- Covered by the same wildcard.
- example.com
- Only covered if example.com is also included in the certificate.
- admin.shop.example.com
- Not covered by *.example.com. It needs its own SAN entry or a suitable separate wildcard.
Your next steps
- Inventory the bare domain, first-level subdomains and any deeper names.
- Check the product details for included base-domain coverage and allowed wildcard SANs.
- Use an available DNS or approver-email method, then verify the issued SAN list.