A wildcard SSL certificate secures your main domain and every subdomain under it (like mail.yourdomain.com or shop.yourdomain.com) using a single certificate, instead of you buying and installing a separate certificate for each one. This guide covers what to prepare and how to install it once you have the certificate files.
What Is a Wildcard SSL Certificate?
A standard SSL certificate covers one specific domain or subdomain, such as www.yourdomain.com. A wildcard certificate covers *.yourdomain.com, meaning it secures the base domain plus any first-level subdomain you create under it, without needing a new certificate each time. It's a practical option if you run several subdomains for things like webmail, a client portal, or a staging site.
A wildcard certificate only covers one level of subdomain. *.yourdomain.com covers shop.yourdomain.com, but not staging.shop.yourdomain.com. If you need to secure a deeper subdomain, you'll need a separate certificate or a multi-level wildcard from your certificate provider.
Before You Begin
To get a wildcard certificate issued, you first need to generate a Certificate Signing Request (CSR) using *.yourdomain.com as the common name, then submit it to a certificate authority to purchase and validate the certificate. If you haven't generated a CSR before, see our guide on generating a CSR for your SSL certificate.
Once your certificate authority validates and issues the certificate, you'll receive:
- The certificate file (usually ending in .crt or .cer)
- Your private key, generated alongside the CSR (keep this safe: it isn't emailed to you again)
- A CA bundle or intermediate certificate file
Have all three ready before you start installing.
Installing the Certificate
In cPanel
- Log in to cPanel and go to the SSL/TLS icon under the Security section.
- Click Manage SSL sites (sometimes labeled Install and Manage SSL for your site (HTTPS)).
- Select your domain from the dropdown list.
- Paste the contents of your certificate file into the Certificate (CRT) box. If the certificate is already on the server, cPanel will try to auto-fill the private key for you.
- Paste your private key into the Private Key (KEY) box if it isn't filled in automatically.
- Paste the CA bundle into the Certificate Authority Bundle (CABUNDLE) box.
- Click Install Certificate.
The wildcard certificate applies automatically to every subdomain once it's installed on the base domain, so you don't need to repeat the install for each one.
In DirectAdmin
- Log in to DirectAdmin and open SSL Certificates under Account Manager.
- Choose Paste a pre-generated certificate and key.
- Paste your certificate and private key into the text box (check your provider's instructions for whether they should be combined together, since some panels expect them in one box and others separate them).
- If you have a separate CA bundle file, paste it into the CA Certificate field.
- Click Save.
After installing, open your site in a browser and check that both the main domain and a subdomain show a valid padlock icon. If you see a mismatch or a "not private" warning, double-check that the private key matches the certificate you installed, and that you pasted the full CA bundle.
Wildcard certificates are usually issued for one year and don't renew automatically unless your certificate authority offers auto-renewal. Set yourself a reminder to renew and reinstall it before it expires, so your subdomains don't lose their padlock.