Does PositiveSSL Wildcard cover second-level subdomains like api.eu.example.com?

No. A wildcard certificate covers exactly one subdomain level beneath the base domain. For example, a wildcard for *.example.com covers api.example.com and shop.example.com, but not api.eu.example.com. Second-level and deeper subdomains require either a separate wildcard certificate for that branch (such as *.eu.example.com) or a multi-domain SAN certificate listing the required hostnames explicitly.

Can I validate a PositiveSSL Wildcard order using a file upload instead of DNS?

In practice, no, for most resellers. Wildcard certificates must prove control over all possible first-level subdomains, which file-based validation cannot reliably demonstrate. DNS-based validation using a CNAME or TXT record is therefore the standard and generally required validation method for wildcard certificate issuance.

What happens if the wildcard certificate's private key is compromised?

If the private key for a wildcard certificate is compromised, every subdomain protected by that certificate must be considered exposed. The certificate should be revoked immediately, a replacement certificate issued, and the new certificate deployed to every server or service that used the compromised key.

Does a wildcard certificate expose my subdomain names publicly?

No. One advantage of wildcard certificates is that Certificate Transparency logs record only the wildcard pattern itself, such as *.example.com, rather than the individual subdomains protected by the certificate. This provides more privacy than issuing separate certificates for each subdomain.

Can a domain block wildcard issuance specifically while still allowing standard certificates?

Yes. CAA DNS records support a dedicated 'issuewild' parameter that controls wildcard certificate issuance separately from the general 'issue' parameter used for standard certificates. A restrictive or absent issuewild record can prevent wildcard certificate issuance even when ordinary certificates remain permitted.

Does using OCSP stapling matter more for a wildcard certificate?

Somewhat, yes, primarily because wildcard certificates are often deployed across multiple servers, load balancers, or edge locations. OCSP stapling should be configured and verified on every deployment location. If stapling is not enabled on a particular server, clients fall back to direct OCSP validation, which can increase connection latency.

How long is a PositiveSSL Wildcard certificate valid in 2026?

As of March 12, 2026, publicly trusted SSL/TLS certificates have a maximum validity period of 199 days per issuance. PositiveSSL Wildcard certificates issued after that date follow the 199-day limit, while certificates issued before the policy change retain their original expiration dates.

Is PositiveSSL Wildcard cheaper than buying separate certificates for each subdomain?

It depends on the number of subdomains you use. For fewer than approximately five active first-level subdomains, individual DV certificates may cost less overall. For larger deployments, a wildcard certificate's ability to secure unlimited first-level subdomains and automatically cover newly created subdomains often makes it more cost-effective despite the higher initial price.

PositiveSSL Wildcard (DV) Certificate Review 2026 | CompareCheapSSL

PositiveSSL Wildcard (DV) Certificate: Review 2026

A genuinely cost-effective way to cover one domain and unlimited first-level subdomains without buying separate certificates for each. The same warranty discrepancy found on the plain PositiveSSL DV certificate shows up here too — confirming this is a pattern across the whole PositiveSSL product family, not a one-off listing error.

Domain Validation (DV) Unlimited first-level subdomains TrustLogo seal (official feature) Warranty: $10K or $50K (confirm) No second-level subdomain coverage

Quick Verdict

Overall

Solid subdomain consolidation at a low price; real TrustLogo seal; buy it for the wildcard coverage, not the warranty

Best For

SaaS platforms with subdomain-per-tenant patterns, agencies with subdomain-based client sites, and any site adding new subdomains over time

Confirm before buying

Warranty varies ($10K–$50K); multi-year subscriptions don't reduce reissuance frequency under 2026 CA/B Forum rules

The Warranty Split: A Pattern Across the PositiveSSL Family

The warranty figure for this certificate varies across resellers in the same way it does for the plain PositiveSSL DV certificate, confirming this is a product-family pattern rather than a single listing error.

Warranty: $10,000 or $50,000?

Source group	Warranty stated
Namecheap, ComodoSSLStore, SSL Dragon, multiple independent sources	$10,000
CheapSSLWeb (July 2026 live listing)	$50,000

At this price tier, the subdomain consolidation value is the reason to buy; the warranty was never the differentiator here. Confirm the figure directly with your chosen reseller if it matters for your risk requirements, but don't let an unresolved discrepancy block a purchasing decision on a certificate priced under $50/yr.

Multi-year subscriptions: pricing lock-in, not reduced maintenance

Some resellers offer multi-year subscriptions at a lower per-year rate. Certera's live listing explicitly states: the certificate you generate will be valid for one year; you must reissue it 30 days before it expires to get a new certificate covering another year. A multi-year subscription buys locked-in pricing across that period, not a certificate that runs untouched. Under the 200-day validity cap effective March 2026 (shrinking further toward 47 days by 2029), reissuance frequency is set by CA/Browser Forum rules, not your subscription term.

Certificate Specifications at a Glance

Spec	Detail
Validation	Domain Validation (DV)
Domain coverage	*.yourdomain.com — unlimited first-level subdomains of one root domain
Second-level subdomains	Not covered (app.staging.yourdomain.com needs its own certificate)
Encryption	256-bit SHA-2, 2048-bit key
Warranty	$10,000 per most sources; $50,000 per CheapSSLWeb — confirm directly
Trust seal	TrustLogo (official PositiveSSL feature, confirmed on PositiveSSL's own site)
Max validity	200 days (effective March 2026); shrinking toward 47 days by 2029
Server licensing	Unlimited
Issuance	Minutes once domain validation completes (fully automated)

What It Actually Costs

Pricing runs from $49/yr to roughly $119/yr across the resellers checked. CheapSSLShop is cheapest at $49/yr for the 1-year plan.

Cheapest 1-year

CheapSSLShop

$49/yr

1-year price; multi-year plans available at lower per-year rate; 30-day money-back guarantee

CheapSSLWeb

$49.99/yr

States $50,000 warranty on this listing; multi-year available; TrustLogo and static seal included

Certera

$49.99/yr

1-year price; multi-year via subscription with annual reissuance; 200-day validity per March 2026 rules

TheSSLStore

~$119/yr

Higher end; SiteLock Monitor bundle available; $10,000 warranty on this listing

Does PositiveSSL Wildcard Actually Reduce SSL Administration?

Managing unlimited subdomains with one certificate

Genuinely, yes. One certificate covers *.yourdomain.com, meaning every first-level subdomain, without buying or reissuing anything when you add a new one.

How much time does it save compared to individual certificates

Real savings once you're past 2 to 3 subdomains: one renewal date and one certificate to track instead of several with staggered expiration dates.

Where administration can still become complicated

Coverage stops at first-level subdomains. A nested subdomain (app.staging.yourdomain.com) isn't covered and needs its own certificate. If your structure includes that kind of nesting, the administrative simplicity this certificate promises doesn't extend that far.

Certificate Management Experience

This section reflects documented vendor and reseller process descriptions, not a first-hand purchase test.

Initial certificate issuance

Fully automated domain validation; the certificate issues almost immediately once domain ownership is confirmed, since no business documentation is involved at this tier.

Reissuing certificates

Unlimited, free reissuance at most resellers, useful if you lose a private key or need to update the certificate's configuration.

Tracking renewals

Standard renewal tracking through whichever reseller's dashboard you purchased through; PositiveSSL itself doesn't appear to offer a distinct management console separate from the reseller or Sectigo's own platform.

Managing multiple certificates from one dashboard

If you're managing several PositiveSSL products together, this depends entirely on your reseller's platform rather than being a unique feature of the Wildcard product itself.

Does the Multi-Year Subscription Model Deliver Real Value?

Annual certificate reissuance

Regardless of the subscription term purchased, the certificate itself must be reissued within current validity limits: 200 days as of March 2026, continuing to shrink toward 47 days by 2029. A multi-year subscription buys locked-in pricing, not a certificate that runs untouched for multiple years.

Subscription pricing vs annual purchases

The genuine value of a multi-year subscription is price predictability, not reduced administrative work, since reissuance still happens on the same accelerating schedule either way.

Long-term operational benefits

Real for budgeting purposes; not real for reducing the actual reissuance workload, which is governed by CA/Browser Forum validity rules, not your subscription term.

How Flexible Is PositiveSSL Wildcard as Your Infrastructure Grows?

Adding new subdomains

No action needed technically: new first-level subdomains under the covered root domain are automatically included.

Deploying across multiple servers

Unlimited server licensing at most resellers; no per-install fee.

Migrating between hosting providers

Straightforward reinstall; no reissuance required unless the actual domain configuration changes.

Handling infrastructure changes

Server migrations and configuration changes don't require a new certificate, only a reinstall of the existing one.

Is the Included TrustLogo Still Valuable in 2026?

TrustLogo is a real, official PositiveSSL feature, confirmed directly on PositiveSSL's own site, not third-party marketing embellishment.

Visitor confidence

PositiveSSL's own site describes it as providing "real-time identity assurance through our 'point to verify' technology." In practice, this is a clickable site seal, not a certificate-level security feature.

Where it adds value

For the minority of visitors who actually click a trust seal before entering payment or personal information, it provides some real, if modest, reassurance.

Where it has little business impact

Most visitors never interact with a site seal at all; don't expect it to meaningfully move conversion numbers on its own. It's a genuine, included feature at this price point, not a reason to choose this certificate over an equivalent one without a seal.

Where PositiveSSL Wildcard Performs Better Than Expected

Strong fit use cases

SaaS platforms with tenant-per-subdomain patterns (tenant1.app.com, tenant2.app.com); these are first-level subdomains covered automatically
Agencies with client sites structured as subdomains of one agency-controlled root domain
Businesses that frequently add new subdomains over time; no new certificate or reissuance required

Not the right tool when...

Each client or property has a genuinely separate domain; this certificate covers subdomains of one root, not multiple distinct domains
Your subdomain structure includes second-level nesting (app.staging.yourdomain.com); those require separate certificates
You need business identity verification displayed to visitors; OV or EV is required for that

Better Alternatives Depending on Your Requirements

SSL.com Wildcard SSL

Worth comparing directly on price; SSL.com competes primarily on cost for budget DV wildcard coverage.

DigiCert Wildcard TLS

Meaningfully pricier for the same core DV wildcard structure; the difference is brand recognition and DigiCert's broader platform, not stronger encryption.

Sectigo Wildcard SSL

Worth clarifying directly: this isn't a separate competing brand. PositiveSSL Wildcard is Sectigo's budget tier; the flagship "Sectigo SSL Wildcard" (also sold under the legacy Comodo name) is a separate, higher tier from the same CA family, carrying a notably larger, more consistently documented warranty at a real price premium. If PositiveSSL's warranty uncertainty bothers you, that flagship tier, not a different CA, is the actual upgrade path.

PositiveSSL Multi-Domain SSL

A different structure entirely: covering several distinct domains rather than subdomains of one root domain. Only relevant if your actual need is multiple separate domains, not subdomain consolidation.

	PositiveSSL Wildcard	Sectigo Wildcard (flagship)	SSL.com Wildcard	DigiCert Wildcard
Validation	DV	DV/OV	DV	DV
Warranty	$10K or $50K (confirm)	Larger, more consistent	Competitive	Higher
Price from	$49/yr	Higher	Competitive	Significantly higher
Trust seal	TrustLogo (confirmed official)	Dynamic seal	Varies	Dynamic seal
Subdomains	First-level only	First-level only	First-level only	First-level only

What We Liked and What Could Be Better

Liked

Genuine, unlimited first-level subdomain coverage at a consistently low price
Real TrustLogo trust seal, confirmed as an official feature on PositiveSSL's own site, not marketing embellishment
SiteLock Monitor bundling available at some resellers, valued up to $120/yr
Unlimited server licensing and free reissuance at most resellers

Could be better

Warranty figure genuinely varies across resellers ($10,000 to $50,000); the same discrepancy pattern confirmed on the plain PositiveSSL DV certificate, affecting the whole product family
No distinct management console specific to this product; renewal tracking depends entirely on your reseller's platform
Multi-year subscriptions buy pricing predictability, not reduced reissuance workload; worth understanding before assuming a longer term means less maintenance

Frequently Asked Questions

Unclear without confirming directly. Sources split between $10,000 (Namecheap, ComodoSSLStore, multiple others) and $50,000 (CheapSSLWeb live listing). The same discrepancy pattern found on the plain PositiveSSL DV certificate, confirming this affects the whole product family.

No. Reissuance is still required within current validity limits (200 days as of March 2026, shrinking toward 47 days by 2029) regardless of subscription length. Multi-year pricing locks in cost, not a longer-lived certificate.

Real, confirmed directly on PositiveSSL's own official site as a "point to verify" clickable trust seal. Its practical business impact is modest (most visitors never interact with site seals), but it's a genuine included feature, not a marketing claim.

No. Coverage is first-level only (*.yourdomain.com). A nested subdomain like app.staging.yourdomain.com isn't covered and needs its own certificate.

PositiveSSL is the budget tier; the flagship Sectigo/Comodo Wildcard product carries a larger, more consistently documented warranty at a higher price. Both are from the same CA family; "Sectigo Wildcard" isn't a competing brand, it's the upgrade tier within the same CA.

Yes. That's the core value of wildcard coverage; new first-level subdomains under *.yourdomain.com are covered automatically without reissuance or extra cost.

Final Verdict

PositiveSSL Wildcard delivers genuine subdomain consolidation at a low price, with a real TrustLogo trust seal and solid server licensing terms. The warranty figure isn't consistently documented across resellers, the same issue found on its single-domain sibling, confirming this is a family-wide pattern worth checking directly rather than a one-off.

Buy it for the subdomain consolidation value. Don't expect a multi-year subscription to reduce how often you'll actually need to reissue it under current CA/B Forum validity rules, and confirm the warranty figure directly if it matters for your requirements.

Compare Items