Covering all subdomains with one certificate.
WHAT IT COVERS
*.yourdomain.com covers any first-level subdomain: shop, blog, mail, staging.
It does not cover the bare domain unless that is listed separately, and it does not cover second-level subdomains such as test.shop.yourdomain.com.
WHEN IT IS USEFUL
You create subdomains frequently, particularly programmatically You run many subdomains and want one certificate to manage An application creates subdomains per customer
VALIDATION
Wildcards require DNS-based validation rather than the file-based method. You add a TXT record the authority specifies.
This means you need access to wherever your DNS is hosted, and the record must be updated at each renewal unless automated.
AUTOSSL ALTERNATIVE
AutoSSL issues certificates covering each subdomain individually, adding new ones automatically. For most accounts this achieves the same result with less work.
THE TRADE-OFF
A wildcard is one certificate and one private key covering everything. If that key is compromised, every subdomain is affected.
