Compare Items
Please, add items to this compare group or choose not empty group
PositiveSSL Wildcard Certificate Review 2026 | CompareCheapSSL

PositiveSSL Wildcard Certificate Review 2026

A DV wildcard issued by Sectigo that secures one base domain and all its first-level subdomains under a single private key. Here is how it behaves at the protocol level, where it fits, what it costs, and what tends to go wrong in practice.

Covers *.example.com and example.com under one certificate
New subdomains automatically covered without reissuance
Single renewal for all subdomains, less overhead than individual certs
!One key compromise exposes every subdomain using this certificate
Domain Validation (DV) From ~$50/yr 199 days max in 2026
CompareCheapSSL
Our Verdict
4.1
out of 5 ★★★★☆
ValidationDV Only
CoverageUnlimited subdomains
From~$50/yr
Warranty$10K to $50K
Validity199 days
Business IDNo

Who Should Buy PositiveSSL Wildcard?

Whether a wildcard makes sense depends almost entirely on how many first-level subdomains the domain runs and whether the subdomain structure is flat. The product has a narrow technical scope and that scope either matches the infrastructure or it does not.

Good Fit

  • One base domain runs five or more first-level subdomains (app., api., status., blog., shop.)
  • New subdomains get added often enough that issuing a fresh certificate each time would be a recurring chore
  • DNS zone access is available to whoever manages the certificate
  • SaaS products with flat subdomain layouts growing over time
  • Agencies managing a single client brand domain with several subdomains

Poor Fit

  • Subdomain structure is nested — api.eu.example.com is outside the wildcard's one-level scope
  • Business identity verification is required — wildcards are DV-only by definition
  • Isolating a key compromise to one subdomain matters more than renewal convenience
  • Kubernetes ingress patterns that generate multi-segment hostnames per namespace
  • Any compliance requirement mandating per-service certificate isolation

What *.example.com Actually Covers

The most common real-world mistake: assuming "all subdomains" means all subdomains at any depth. It does not. The match is exactly one label deep from the base domain.

Hostname RequestedCovered?Reason
www.example.comYesFirst-level subdomain, matches the wildcard pattern
shop.example.comYesFirst-level subdomain, matches the wildcard pattern
api.example.comYesFirst-level subdomain, matches the wildcard pattern
example.com (bare root)Only if SAN includedThe bare domain needs an additional SAN entry at issuance time
staging.shop.example.comNoSecond-level subdomain, outside the wildcard's one-level scope
example.netNoDifferent root domain entirely
*.shop.example.comNoRequires a separate wildcard or SAN entry for that specific branch
ℹ️
Always request both SANs: When ordering, request both *.example.com and example.com as SAN entries. Omitting the bare domain entry is one of the most common post-issuance surprises.

Single SSL vs Wildcard SSL: What Actually Costs Less

The crossover point sits around five active first-level subdomains. Below that, individual DV certificates are often cheaper outright. Above it, the wildcard's single renewal and flat pricing outweigh the higher upfront cost, especially once renewal labor is factored in.

Subdomains NeededIndividual DV CertsPositiveSSL WildcardCheaper Option
1 to 2$4 to $16/year$50 to $70/yearIndividual certs
3 to 4$12 to $32/year$50 to $70/yearRoughly breaks even
5 to 8$20 to $64/year$50 to $70/yearWildcard
9 or more$36+/year, growing$50 to $70/year, flatWildcard, by a wide margin
⚠️
The table understates individual cert cost. It counts only the certificate price, not the labor of tracking and reissuing several separate expiration dates instead of one. Adding even modest renewal overhead shifts the breakeven point lower.
ℹ️
Let's Encrypt changes the math. Free automated DV certificates push the individual-certificate column toward $0 for technical teams with ACME automation already in place. In that scenario the wildcard's price advantage over individual certs disappears.

Common Problems and Fixes

Most issues with PositiveSSL Wildcard deployments fall into five recurring patterns. All of them are preventable with the right checks at issuance and deployment time.

ProblemCauseFix
NET::ERR_CERT_AUTHORITY_INVALID on some clients Missing intermediate certificate in the server's chain bundle Install the full chain including the Sectigo RSA Domain Validation intermediate, not just the leaf certificate
Valid on main site but not a new subdomain Subdomain does not match the wildcard — it is second-level or contains a typo Confirm the hostname against SAN entries: openssl x509 -noout -text -in cert.crt | grep DNS:
Order fails at issuance with no clear error A restrictive issuewild CAA record on the domain Check dig CAA example.com before ordering; adjust the record if wildcard issuance should be permitted
Works on one server but not another in a load-balanced pool Configuration drift — new certificate not deployed to every backend after reissuance Use a deployment script or configuration management tool that pushes the certificate to all backends atomically
Bare root domain shows an error while subdomains work Certificate issued with only the wildcard SAN, missing the base domain Reissue requesting both *.example.com and example.com as SAN entries

PositiveSSL Wildcard Renewal Checklist

Validity is now capped at 199 days as of March 12, 2026, so renewal happens roughly twice a year instead of once. Check each item before triggering reissuance.

Confirm the domain's current CAA records still permit wildcard issuance (dig CAA example.com)
Verify DNS zone access is intact, the validation record can be created again
Reissue the certificate and confirm the SAN extension includes both the wildcard and the base domain
Deploy the new certificate and key to every server, load balancer, or CDN edge configuration using the old one
Confirm OCSP stapling is serving a current response post-deployment, not a cached response from the old certificate
Set a reminder for the next renewal cycle at 180 days out, not 360

Security Risks of Using a Wildcard Certificate

The structural trade-off behind every wildcard certificate: one private key secures every subdomain it is deployed to.

🔐
Key compromise = full exposure. If that key is compromised on any single server, every subdomain using the certificate is considered compromised. The correct response is revoking and reissuing across the entire deployment, not just patching the one breached instance. Individually issued certificates do not carry this property.

This risk scales with how widely the key is distributed. A wildcard deployed to a single server behind a single load balancer carries modest exposure. The same wildcard's key copied across a dozen edge nodes, several CDN configurations, and multiple environments multiplies the number of places a compromise could originate, while the consequence stays the same regardless of where the breach occurred.

CT Log advantage: Because the certificate is issued for the pattern *.example.com rather than named subdomains, Certificate Transparency logs show only the pattern. Individual certificates for internal-admin.example.com or staging.example.com expose those exact hostnames permanently in a public, searchable log.

PositiveSSL Wildcard vs. Alternatives

Three comparisons that actually matter for most buyers making this purchase decision.

The comparison that actually matters for most buyers — a real free-vs-paid decision rather than a choice between similar paid products.

PositiveSSL Wildcard

Cost$50 to $70/year
ValidationDNS (in practice)
Validity199 days
Warranty$10K to $50K
SupportReseller-provided
AutomationOptional

Let's Encrypt Wildcard

CostFree
ValidationDNS-01 only
Validity90 days (45 by 2028)
WarrantyNone
SupportCommunity only
AutomationEffectively required
💡
How to choose: Choose Let's Encrypt if ACME automation is already in place. Choose PositiveSSL Wildcard if there is no appetite to build or maintain ACME tooling, if a CA-backed warranty matters, or if a vendor support line is needed when something breaks.

The closest direct competitor in both price and validation tier. Practical differences are narrow.

PositiveSSL Wildcard

Root chainUSERTrust RSA (Sectigo)
Price range$50 to $70/year
Warranty$10K to $50K (varies)
Refund window~15 days post-issuance
Warranty transparencyInconsistent across resellers

AlphaSSL Wildcard

Root chainGlobalSign Root
Price range$40 to $99/year
Warranty$10K (consistent)
Refund window7 days flat
Warranty transparencyConsistent across listings
💡
Bottom line: There is no technical reason to prefer one over the other. Both chains have been in every major browser's trust store for well over a decade. This comes down to which reseller offers better support and pricing for the specific purchase.

This comparison is really a DV-vs-OV decision wearing a brand-name disguise. GeoTrust and DigiCert charge 3x to 10x more, and the jump buys two specific things: a substantially larger warranty and business identity verification.

PositiveSSL Wildcard

ValidationDV only
Price$50 to $70/year
Warranty$10K to $50K
Business identityNo
Best forBlogs, SaaS, internal tools

GeoTrust / DigiCert Wildcard

ValidationDV or OV
Price$190 to $606+/year
Warranty$1.25M to $1.5M+
Business identityYes (OV tier)
Ecommerce, regulated industries
⚠️
When the premium is worth it: For platforms handling payment data, regulated information, or enterprise customers whose procurement team checks the certificate's validation level, the OV tier and larger warranty are the actual point. PositiveSSL's DV-only model cannot substitute for it regardless of price savings.

Key Changes for Wildcard Certificates in 2026

The same CA/Browser Forum-driven changes affecting every public certificate apply to PositiveSSL Wildcard, but with one specific consequence for wildcard deployments worth calling out separately.

ChangeDetailImpact on Wildcards Specifically
Shorter validity Maximum validity dropped to 199 days as of March 12, 2026 Renewal now has to be coordinated and redeployed everywhere the key lives roughly twice a year. Missing one instance leaves that server serving an outdated certificate until caught.
Shorter DCV reuse Domain Control Validation can only be reused for up to 198 days The underlying domain check must be repeated more frequently too. DNS zone access needs to be reliably available before each renewal cycle.
🕐
Certificates issued before March 12, 2026 keep their original expiration date and are not affected until their next reissuance. Once they expire or are manually reissued, the 199-day limit applies.

Should You Buy PositiveSSL Wildcard?

For SaaS products and agencies managing a single brand domain with growing subdomain sprawl above five first-level subdomains, the wildcard's single renewal cycle and automatic coverage of new subdomains earn their higher price. For nested architectures or strict isolation requirements, per-service ACME automation addresses the actual need more directly.

Buy It If

  • The domain runs five or more first-level subdomains on a flat structure
  • DNS zone access is available to whoever manages the certificate
  • No business identity verification (OV or EV) is required
  • New subdomains are added regularly and manual reissuance is impractical

Frequently Asked Questions

No. A wildcard covers exactly one subdomain level beneath the base domain. Second-level and deeper subdomains need a separate wildcard for that specific branch or a multi-domain SAN certificate listing each pattern explicitly.
In practice, no, for most resellers. Wildcard orders need to prove control over an undefined set of subdomains, which a single file path cannot do, so DNS-based validation (CNAME or TXT) is the standard method even where the interface still lists other options.
Every subdomain covered by that certificate is considered exposed, not just the affected server. The certificate has to be revoked and reissued, and the new certificate redeployed everywhere the old one was installed. This is the principal structural risk of a shared-key wildcard versus per-service certificates.
No — and this is one of its genuine advantages. Because the certificate is issued for the wildcard pattern rather than named subdomains, Certificate Transparency logs show only the pattern, not the actual subdomain names in use. Individually issued certificates for staging.example.com or internal-admin.example.com expose those exact hostnames permanently in public, searchable CT logs.
Yes. CAA DNS records support an issuewild tag, distinct from the general issue tag, that can restrict or block wildcard issuance independently. Check a domain's current CAA records with dig CAA example.com before ordering — a restrictive issuewild record causes the order to fail at issuance regardless of how DCV is configured.
A maximum of 199 days per issuance as of March 12, 2026. Certificates issued before that date keep their original expiration. A multi-year subscription still bills across multiple years, but you need to reissue the certificate file roughly every six months and redeploy everywhere it is installed.
It depends on subdomain count. Below roughly five active first-level subdomains, individual DV certificates are often cheaper outright. Above that threshold, the wildcard's single renewal and automatic coverage of new subdomains tend to outweigh the higher upfront price, particularly once renewal management labor is counted.

Ready to Compare SSL Certificates?

PositiveSSL Wildcard suits domains with five or more subdomains on a flat structure. Use our comparison table to see all wildcard options side by side.