Wildcard SSL Certificate on Shared Hosting: When to Use It and How to Install

A wildcard SSL certificate covers your main domain and all its single-level subdomains with a single certificate — for example, *.yourdomain.com protects store.yourdomain.com, blog.yourdomain.com, and app.yourdomain.com all at once. If you manage multiple subdomains on shared hosting, it's the most practical and cost-effective option compared to installing individual SSL certificates for each one.

Wildcard SSL vs Standard SSL: Which Do You Need?

Before installing any certificate, it's worth clarifying the difference so you don't spend money where you don't need to.

Use a standard SSL if you only have www and the root domain. Use a wildcard if you already have — or plan to have — two or more distinct subdomains under the same domain.

When a Wildcard Makes Sense on Shared Hosting

Shared hosting handles wildcard certificates just fine, with one important constraint: validation must always be done via DNS challenge, not via HTTP file. This means you need access to your domain's DNS records — usually inside the same cPanel or at your domain registrar.

Scenarios where wildcard is the right choice:

• You have an online store (store.domain.com) and a separate blog (blog.domain.com) on the same hosting account.
• You offer a client portal on a subdomain (clients.domain.com) and use another for staging (dev.domain.com).
• You manage an agency or school with a subdomain per department: students.domain.com, teachers.domain.com, admin.domain.com.
• You create subdomains dynamically and don't want to issue a new certificate each time.

Scenarios where you don't need a wildcard:

• You only have the root domain and www: a Let's Encrypt SSL covering both as SANs is sufficient and free.
• You have one additional subdomain: you can add it as a SAN to a standard certificate instead of paying for a wildcard.

How to Install a Wildcard SSL on cPanel: Step by Step

There are two paths: (A) let Let's Encrypt issue it automatically via AutoSSL if your host supports it, or (B) generate the certificate yourself and upload it manually. Option A is simpler; Option B is required when your provider doesn't offer wildcard in AutoSSL.

Path A — AutoSSL with Wildcard (Hostinger, select Neubox plans, SiteGround)

1. Log in to cPanel → Security section → SSL/TLS.
2. Click Manage SSL Sites (or "Let's Encrypt SSL" if your provider has a dedicated plugin).
3. Find your domain in the list and check the Wildcard or *.yourdomain.com option.
4. The system will ask you to add a TXT record in your DNS: copy the value shown on screen.
5. Go to DNS in cPanel (or your registrar's panel) and create the _acme-challenge.yourdomain.com TXT record with the provided value.
6. Wait 1–5 minutes for propagation, then confirm issuance in the SSL panel.
7. The certificate installs automatically. Verify in your browser that https://any-subdomain.yourdomain.com shows the padlock.

Path B — External Wildcard Certificate (Commercial or Manual Certbot)

If your host doesn't offer wildcard in AutoSSL, or you prefer a commercial CA certificate (DigiCert, Sectigo, etc.):

1. Generate a CSR: in cPanel → SSL/TLS → Generate, view, upload, or delete SSL keys. Create a 2048 or 4096-bit key, then under Certificate Signing Requests (CSR) generate a CSR with Common Name *.yourdomain.com.
2. Purchase or issue the wildcard: paste the CSR into your CA's portal. Complete DNS validation (they'll give you a TXT record to add in your DNS, just like Path A).
3. Download the files: you'll receive the certificate (.crt), the intermediate chain (ca-bundle.crt or similar), and you already have the private key in cPanel.
4. Install in cPanel: go to SSL/TLS → Manage SSL Sites → select the domain → paste the certificate into the Certificate (CRT) field, the private key into Private Key (KEY), and the chain into Certificate Authority Bundle (CABUNDLE) → click Install Certificate.
5. Applies to all subdomains: cPanel associates the wildcard with the main domain; any subdomains you create afterward are covered automatically.

If you run Certbot locally (not on the server), you can issue the wildcard with:

certbot certonly --manual --preferred-challenges dns \
  -d "*.yourdomain.com" -d "yourdomain.com"

Follow the prompts to add the TXT record, then download the generated files and upload them to cPanel as described in step 4 of Path B.

Common Mistakes and How to Avoid Them

• Wildcard doesn't cover the root domain: *.yourdomain.com protects subdomains but not yourdomain.com on its own. Always issue the cert with both: *.yourdomain.com + yourdomain.com.
• Incomplete DNS propagation: if validation fails, wait longer or use dig TXT _acme-challenge.yourdomain.com @8.8.8.8 to verify the record is already visible.
• Incomplete certificate chain: if you install a commercial cert without the intermediate bundle, some browsers (especially on Android) will show an error. Always include the CA chain.
• Forgetting manual renewal: Let's Encrypt wildcards expire after 90 days. If issued manually, set a reminder or automate renewal with a cron that runs Certbot and re-installs the cert.

If you're unsure which option suits your project, the specialists at elenlace.com can advise you and handle the installation — including setting up automatic renewal.

Key Takeaways

• A wildcard certificate covers *.yourdomain.com in a single cert; it does not cover sub-subdomains or the root domain unless explicitly included.
• Wildcard validation always requires a DNS challenge; HTTP-based validation is not supported.
• If you only have www and the root domain, a free standard SSL (Let's Encrypt) is sufficient; wildcard only adds value with two or more subdomains.
• cPanel makes it easy to install both automatic wildcards (AutoSSL) and manual ones (uploading CRT + KEY + bundle).
• Always schedule renewal: Let's Encrypt wildcards expire in 90 days.

Would you rather delegate SSL certificate management and never worry about renewals or chain errors? At elenlace.com we handle all the SSL configuration for your hosting so you can focus on your business. Find more technical guides in our comparisons section.

FAQ

Does Let's Encrypt offer free wildcard certificates?

Yes. Let's Encrypt issues wildcard certificates at no cost using the ACME protocol with DNS challenge. The limitation is that renewal also requires updating the TXT record in DNS, so you need to automate it or do it manually every 90 days.

Will the wildcard certificate work for any subdomain I create in the future?

Yes, that's its main advantage. Once installed in cPanel, any new subdomain you add under *.yourdomain.com is automatically covered — no need to issue or install anything additional.

Can I use the same wildcard on multiple different hosting accounts?

Technically yes: the certificate file and private key can be installed on multiple servers. However, sharing a private key across different environments increases security risk; in that case it's better to issue an independent certificate for each server.

What if my hosting provider doesn't support wildcard in AutoSSL?

You'll need to use Path B: issue the wildcard externally (with Certbot on your local machine or by purchasing a commercial cert) and upload it manually to cPanel. The process takes less than 15 minutes, and the result is identical in security and coverage.

Compare providers

Other providers and guides worth comparing:

• HubSpot
• IONOS
• GoDaddy