What Is Wildcard SSL Certificate?

Why It Matters

Without a wildcard certificate, you need a separate SSL certificate for each subdomain. If you’re forwarding www.example.com, blog.example.com, shop.example.com, and app.example.com — that’s four certificates to manage. A wildcard certificate covers them all with *.example.com.

How Wildcard Certificates Work

Certificate	Covers	Doesn’t Cover
*.example.com	www.example.com, blog.example.com, anything.example.com	example.com (apex), a.b.example.com
example.com	example.com only	Any subdomain
SAN cert	Explicitly listed domains	Anything not listed

Important: A wildcard certificate for *.example.com does not cover the apex domain example.com itself. You typically need both *.example.com and example.com on the same certificate.

Wildcard Certificates and Forwarding

Wildcard certificates pair with wildcard forwarding — where any subdomain of your domain gets forwarded:

*.old-brand.com → new-brand.com

This requires:

1. A wildcard DNS record pointing to the forwarding server
2. A wildcard SSL certificate on the forwarding server
3. Forwarding logic to handle all incoming subdomains

Domain Forward handles all three automatically when you enable wildcard forwarding.