A wildcard SSL certificate (*.yourdomain.com) secures your root domain and every subdomain under a single certificate. On Neubox shared hosting, installing one requires a few specific steps inside cPanel.
What Is a Wildcard SSL and When Do You Need One?
A wildcard SSL covers *.yourdomain.com — meaning any subdomain: store.yourdomain.com, blog.yourdomain.com, app.yourdomain.com, and so on. A standard certificate only protects the exact domain it was issued for.
You need a wildcard when:
- You have multiple active subdomains or plan to create them.
- You run a SaaS platform or store with per-client subdomains.
- You want to avoid renewing individual certificates for each subdomain.
Important limitation: a single-level wildcard (*.yourdomain.com) does not cover second-level subdomains like dev.store.yourdomain.com. You would need an additional wildcard or a multi-domain (SAN) certificate for that.
Wildcard SSL Options on Neubox
Neubox offers three paths to get a wildcard SSL:
| Option | Cost | Difficulty | Best For |
|---|---|---|---|
| Paid wildcard SSL (Neubox/Comodo) | From ~$800 MXN/year | Medium | Commercial sites requiring trusted CA |
| Let's Encrypt wildcard (manual/DNS) | Free | Medium-high | Personal projects, developers |
| SSL included in plan (root domain) | Included | Low | Root domain only, no subdomains |
The automatic SSL Neubox activates by default in cPanel is not a wildcard — it only covers the root domain and www. For additional subdomains you must install a separate wildcard certificate.
Step by Step: Installing a Wildcard SSL in Neubox cPanel
This process applies to both a certificate purchased from Neubox and one generated with Certbot (Let's Encrypt). The only difference is where the certificate files come from.
1. Generate the CSR (Certificate Signing Request)
Log in to your Neubox cPanel and navigate to Security → SSL/TLS → SSL/TLS Manager → Generate, view, or delete SSL certificate signing requests (CSR).
- In the Domains field, enter:
*.yourdomain.com(with the asterisk). - Fill in the country, state, city, organization, and email fields.
- Click Generate.
Copy the resulting CSR block — you will need it when submitting your request to the Certificate Authority (CA).
2. Validate the Domain via DNS (Required for Wildcards)
Wildcard certificates can only be validated via DNS, not via HTTP file. Your CA will provide a TXT record that you must add to your domain's DNS zone.
- In cPanel go to Domains → DNS Zone Editor.
- Add the TXT record exactly as specified by your CA (name and value).
- Wait for DNS propagation — this can take anywhere from 5 minutes to 2 hours.
If you are using Certbot (Let's Encrypt) on another server to generate the certificate manually, the command would be:
certbot certonly --manual --preferred-challenges dns -d "*.yourdomain.com" -d "yourdomain.com"Certbot will give you the TXT record. Add it to the DNS in Neubox cPanel as described above, then confirm the validation in the terminal.
3. Install the Certificate in cPanel
Once your CA issues the certificate (or Certbot generates it), you will have three files: the certificate (.crt), the private key (.key), and the CA bundle (ca-bundle.crt or chain.pem).
- In cPanel go to SSL/TLS → Install and Manage SSL for your site (HTTPS) → Manage SSL Sites.
- Select your root domain (
yourdomain.com) from the dropdown. - Paste the contents of each file into its corresponding field: Certificate, Private Key, and Certificate Authority Bundle.
- Click Install Certificate.
The wildcard installed on the root domain automatically protects all active subdomains in that cPanel account.
4. Force HTTPS on All Subdomains
Installing the certificate does not redirect traffic automatically. To force HTTPS, edit the .htaccess file at the root of each subdomain (or the root domain for all of them):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]You can also enable the "Force HTTPS Redirect" toggle in cPanel's SSL manager if it is available on your Neubox plan.
Common Troubleshooting Issues
- "Certificate does not match domain" error: verify that the CSR was generated with
*.yourdomain.comand not just the root domain. - Subdomain still loading on HTTP: check that the subdomain is created in cPanel and that the
.htaccessredirect is in its root directory. - Incomplete certificate chain: make sure you paste the CA bundle. A poorly chained SSL shows warnings in some browsers even if the padlock appears green.
- Let's Encrypt not auto-renewing: on shared hosting without root access, automatic renewal with Certbot is not possible. You will need to repeat the manual process every 90 days or purchase a paid annual wildcard.
If you manage multiple web properties, elenlace.com offers specialized consulting on SSL management and web security for Mexican agencies and businesses.
Key Takeaways
- Neubox's default SSL only covers the root domain; for subdomains you need a wildcard (
*.yourdomain.com). - Wildcards must always be validated via DNS — there is no HTTP file option for this certificate type.
- You can use a paid wildcard (Comodo/Sectigo) or generate a free one with Let's Encrypt and Certbot in manual mode.
- After installing the certificate in cPanel, force HTTPS with an
.htaccessrule or the panel toggle. - Let's Encrypt wildcards do not auto-renew on shared hosting — set a reminder every 80–85 days or use a paid annual wildcard.
Ready to secure all your subdomains at once? Browse more technical guides in our hosting comparisons and tutorials section, or reach out to elenlace.com if you'd rather have an expert handle the setup for you.
FAQ
Does a wildcard SSL cover the root domain (without a subdomain)?
A wildcard *.yourdomain.com technically does NOT cover the bare yourdomain.com. That's why you should include both *.yourdomain.com and yourdomain.com (without the asterisk) when generating the CSR and installing the certificate. Most modern CAs allow both to be included in the same certificate at no extra charge.
Can I use a Let's Encrypt wildcard on Neubox without SSH access?
Yes, but only manually. You need to generate the certificate on another machine using Certbot, add the DNS TXT validation record in Neubox's cPanel DNS editor, and then paste the generated files into the cPanel SSL installer. Automation is not possible on shared hosting without root access.
How much does a paid wildcard SSL cost on Neubox?
Prices vary by plan and CA, but typically range from $800 to $2,500 MXN per year depending on whether you need DV (domain validation) or OV (organization validation). Check directly with Neubox for current pricing.
Will the wildcard work for subdomains created after installation?
Yes. The wildcard covers any first-level subdomain regardless of when it was created. When you add a new subdomain in cPanel, it will already be protected by HTTPS automatically — no need to reinstall the certificate.
Compare providers
Other providers and guides worth comparing:
