When it's time to secure your site, you'll quickly run into a choice that isn't obvious: do you need a wildcard SSL certificate or a multi-domain one? They sound similar, they both cover more than a single address, and picking the wrong one means either paying for coverage you don't need or discovering a domain isn't protected. The good news is the decision is simple once you understand what each type actually covers. Here's the difference between wildcard and multi-domain SSL certificates — and which one you need.
Quick recap: SSL certificate coverage types
Certificates differ in how many names they secure. There are three coverage types: single-domain (one hostname), wildcard (a domain and its subdomains), and multi-domain (several separate domains). All of them provide the same encryption — the difference is purely what they cover. Our guide on what an SSL certificate is covers the broader picture; this article focuses on choosing between wildcard and multi-domain.
What is a wildcard SSL certificate?
A wildcard certificate secures a single domain plus all of its subdomains at one level, using an asterisk: *.example.com. That one certificate covers:
blog.example.comshop.example.comapp.example.commail.example.com- …and any other subdomain you add, without needing a new certificate each time.
The key point: a wildcard covers one main domain and its subdomains. It doesn't secure a completely different domain like example.net. It's ideal when you have a single domain but lots of subdomains — especially if you add new ones regularly.
What is a multi-domain (SAN) SSL certificate?
A multi-domain certificate — also called a SAN certificate (after the "Subject Alternative Name" field it uses) or a UCC certificate — secures multiple distinct domains under one certificate. For example, a single multi-domain certificate could cover:
example.comexample.netexample.co.ukmycompletelydifferentbrand.com
The key point: a multi-domain certificate covers several separate domains at once. It's ideal when you run multiple websites or brands and want to manage their security with a single certificate instead of one per domain.
Wildcard vs multi-domain: the key difference
Here's the distinction in one line:
- A wildcard secures one domain and all its subdomains (
*.example.com). - A multi-domain secures many different domains (
example.com+example.net+brand2.com).
So the question to ask is: Do I need to cover lots of subdomains of one site, or lots of separate domains? That single answer usually points you straight to the right type.
When to choose a wildcard certificate
A wildcard is the right pick when:
- You have one main domain with multiple subdomains — a blog, store, app, help center, and so on.
- You add subdomains frequently and don't want to reissue a certificate each time.
- All those subdomains live under the same domain name.
For a typical business running everything under one domain, a wildcard is the simplest, most future-proof choice.
When to choose a multi-domain (SAN) certificate
A multi-domain certificate is the right pick when:
- You run several distinct websites or brands on different domains.
- You want to secure a domain plus its country variants (
.com,.co.uk,.de) together. - You'd rather manage one certificate than juggle a separate one for each site.
If your setup spans multiple domain names rather than subdomains, multi-domain is what you need.
Can you combine them?
Yes — a multi-domain wildcard certificate exists, and it does exactly what the name suggests: it secures **multiple domains and all their subdomains** under one certificate. For example, it could cover *.example.com and *.example.net together. This is the most flexible (and typically most expensive) option, suited to larger organizations juggling several domains that each have many subdomains.
What about a single-domain certificate?
Don't overlook the simplest option. If you just have one website on one domain with few or no subdomains, a single-domain certificate is all you need — and it's often free. Providers like Let's Encrypt issue single-domain and wildcard certificates at no cost, so many small sites are fully covered without paying anything. Only step up to multi-domain when you genuinely have multiple separate domains to secure.
How to decide
Run through this quickly:
- One domain, one or two pages, no subdomains? → Single-domain certificate.
- One domain with many (or growing) subdomains? → Wildcard.
- Several separate domains or brands? → Multi-domain (SAN).
- **Multiple domains that each have many subdomains?** → Multi-domain wildcard.
Whichever you choose, you can confirm exactly which names a certificate covers by checking its details — our free SSL Certificate Checker shows the covered domains, and our guide on how to check an SSL certificate explains reading the Common Name and SAN fields.
The bottom line
The wildcard-versus-multi-domain choice comes down to one question: are you covering subdomains of one domain or several different domains? A wildcard (*.example.com) secures a single domain and all its subdomains; a multi-domain (SAN) certificate secures multiple distinct domains; and a multi-domain wildcard does both. For a single simple site, a free single-domain certificate is plenty. Match the certificate to the shape of your setup, and you'll pay only for the coverage you actually need — with every domain and subdomain properly protected.