A wildcard SSL certificate (*.yourdomain.com) secures your root domain and every first-level subdomain with a single file. If you already have the certificate, installing it in cPanel takes under ten minutes.
What Is a Wildcard SSL and When Do You Need One?
A wildcard uses an asterisk (*) as a placeholder in the Common Name field. This means *.yourdomain.com validates store.yourdomain.com, blog.yourdomain.com, api.yourdomain.com, and any other first-level subdomain — but it does not cover second-level subdomains like dev.store.yourdomain.com.
You need a wildcard when:
- You have three or more active subdomains.
- You plan to create new subdomains frequently.
- You want to avoid renewing separate certificates for each one.
Browse more SSL topics and guides in our SSL security resource hub.
What You Need Before You Start
- The wildcard certificate issued by your CA (
.crtfile). - The private key generated alongside the CSR (
.keyfile). - The CA bundle (intermediate chain, sometimes called
ca-bundleorchain.crt). - cPanel login credentials.
- Your subdomains already created in cPanel under Domains → Subdomains.
If you don't have the certificate yet, generate a CSR first from Security → SSL/TLS → Generate a CSR. Enter *.yourdomain.com in the Domain field.
Step-by-Step: Installing the Certificate in cPanel
1. Open the SSL/TLS Manager
Log in to cPanel and go to Security → SSL/TLS. Click Manage SSL Sites (sometimes labeled Install and Manage SSL for your site).
2. Select the Domain
From the Domain dropdown, choose yourdomain.com (the root domain, without the asterisk). cPanel will automatically apply the wildcard to all subdomains.
3. Paste the Certificate Files
Open each file in a text editor and paste its contents into the corresponding field:
| cPanel field | File to paste |
|---|---|
| Certificate (CRT) | Your .crt file (starts with -----BEGIN CERTIFICATE-----) |
| Private Key (KEY) | Your .key file |
| Certificate Authority Bundle (CABUNDLE) | The CA's intermediate chain file |
If you click Autofill by Certificate, cPanel will try to populate the key and bundle if you uploaded them previously. Double-check that no field is left empty.
4. Install the Certificate
Click Install Certificate. cPanel will display a success message if everything matches. If you see a key-mismatch error, make sure you're using the private key that was generated alongside the CSR you submitted to the CA.
5. Verify Each Subdomain
Open your browser and visit https://subdomain.yourdomain.com. The padlock should appear and the certificate details should show *.yourdomain.com. For a thorough check, run the domain through SSL Labs at ssllabs.com/ssltest.
Forcing HTTPS on All Subdomains
Installing the certificate does not automatically redirect HTTP traffic. You have two options:
- cPanel toggle: enable the Force HTTPS switch under Domains → Domains for each subdomain.
- .htaccess rule: add the following to each subdomain's
.htaccess:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]If you plan to enable HSTS afterward, confirm the redirect works correctly first — a misconfigured HSTS header can lock visitors out of your site for months.
Troubleshooting Common Issues
Error: private key does not match the certificate
This happens when the certificate was issued against a different CSR. Generate a new CSR in cPanel, submit it to your CA for a reissue, and install the new certificate.
Padlock not showing on a specific subdomain
Check that the subdomain's DNS A record points to the same server. If it resolves to a different IP, the destination server doesn't have the certificate installed.
Mixed-content warning
Browsers flag pages that load resources (images, scripts) over HTTP even when the page itself is HTTPS. Update any hardcoded HTTP URLs in your CMS or use a URL-replacement plugin.
The team at elenlace.com helps agencies and businesses configure SSL infrastructure correctly from day one — no errors, no downtime.
Key Takeaways
- A wildcard
*.yourdomain.comcovers all first-level subdomains with one certificate. - You need the CRT, KEY, and CA bundle to install correctly in cPanel.
- Select the root domain in cPanel; the wildcard applies to subdomains automatically.
- Force HTTPS via the cPanel toggle or an
.htaccessredirect rule. - Validate the full chain with SSL Labs before going live.
Ready to protect all your subdomains at once? Reach out to the experts at elenlace.com for guidance on choosing and installing the right certificate for your project.
FAQ
Does a wildcard cover second-level subdomains like dev.api.yourdomain.com?
No. A standard wildcard only covers one subdomain level (*.yourdomain.com). To cover second-level subdomains you need an additional wildcard (*.api.yourdomain.com) or a multi-SAN certificate.
Can I use Let's Encrypt as a wildcard in cPanel?
Yes, provided your hosting provider's AutoSSL plugin supports wildcard issuance. It requires DNS-01 validation, meaning cPanel must be able to edit your DNS records automatically. Not all providers support this.
How long does a wildcard certificate last?
Modern SSL certificates have a maximum validity of 398 days (just over one year). Many CAs offer auto-renewal plans to prevent service interruptions.
Do I need to restart Apache after installing the certificate?
cPanel handles the reload automatically when you click Install Certificate. Manual Apache restarts are only necessary if you edit configuration files directly outside of cPanel.
Further reading
Other providers and guides worth comparing:
