PositiveSSL Wildcard Certificate Review 2026
A DV wildcard issued by Sectigo that secures one base domain and all its first-level subdomains under a single private key. Here is how it behaves at the protocol level, where it fits, what it costs, and what tends to go wrong in practice.
Who Should Buy PositiveSSL Wildcard?
Whether a wildcard makes sense depends almost entirely on how many first-level subdomains the domain runs and whether the subdomain structure is flat. The product has a narrow technical scope and that scope either matches the infrastructure or it does not.
Good Fit
- One base domain runs five or more first-level subdomains (app., api., status., blog., shop.)
- New subdomains get added often enough that issuing a fresh certificate each time would be a recurring chore
- DNS zone access is available to whoever manages the certificate
- SaaS products with flat subdomain layouts growing over time
- Agencies managing a single client brand domain with several subdomains
Poor Fit
- Subdomain structure is nested — api.eu.example.com is outside the wildcard's one-level scope
- Business identity verification is required — wildcards are DV-only by definition
- Isolating a key compromise to one subdomain matters more than renewal convenience
- Kubernetes ingress patterns that generate multi-segment hostnames per namespace
- Any compliance requirement mandating per-service certificate isolation
What *.example.com Actually Covers
The most common real-world mistake: assuming "all subdomains" means all subdomains at any depth. It does not. The match is exactly one label deep from the base domain.
| Hostname Requested | Covered? | Reason |
|---|---|---|
www.example.com | Yes | First-level subdomain, matches the wildcard pattern |
shop.example.com | Yes | First-level subdomain, matches the wildcard pattern |
api.example.com | Yes | First-level subdomain, matches the wildcard pattern |
example.com (bare root) | Only if SAN included | The bare domain needs an additional SAN entry at issuance time |
staging.shop.example.com | No | Second-level subdomain, outside the wildcard's one-level scope |
example.net | No | Different root domain entirely |
*.shop.example.com | No | Requires a separate wildcard or SAN entry for that specific branch |
*.example.com and example.com as SAN entries. Omitting the bare domain entry is one of the most common post-issuance surprises.Single SSL vs Wildcard SSL: What Actually Costs Less
The crossover point sits around five active first-level subdomains. Below that, individual DV certificates are often cheaper outright. Above it, the wildcard's single renewal and flat pricing outweigh the higher upfront cost, especially once renewal labor is factored in.
| Subdomains Needed | Individual DV Certs | PositiveSSL Wildcard | Cheaper Option |
|---|---|---|---|
| 1 to 2 | $4 to $16/year | $50 to $70/year | Individual certs |
| 3 to 4 | $12 to $32/year | $50 to $70/year | Roughly breaks even |
| 5 to 8 | $20 to $64/year | $50 to $70/year | Wildcard |
| 9 or more | $36+/year, growing | $50 to $70/year, flat | Wildcard, by a wide margin |
Common Problems and Fixes
Most issues with PositiveSSL Wildcard deployments fall into five recurring patterns. All of them are preventable with the right checks at issuance and deployment time.
| Problem | Cause | Fix |
|---|---|---|
| NET::ERR_CERT_AUTHORITY_INVALID on some clients | Missing intermediate certificate in the server's chain bundle | Install the full chain including the Sectigo RSA Domain Validation intermediate, not just the leaf certificate |
| Valid on main site but not a new subdomain | Subdomain does not match the wildcard — it is second-level or contains a typo | Confirm the hostname against SAN entries: openssl x509 -noout -text -in cert.crt | grep DNS: |
| Order fails at issuance with no clear error | A restrictive issuewild CAA record on the domain | Check dig CAA example.com before ordering; adjust the record if wildcard issuance should be permitted |
| Works on one server but not another in a load-balanced pool | Configuration drift — new certificate not deployed to every backend after reissuance | Use a deployment script or configuration management tool that pushes the certificate to all backends atomically |
| Bare root domain shows an error while subdomains work | Certificate issued with only the wildcard SAN, missing the base domain | Reissue requesting both *.example.com and example.com as SAN entries |
PositiveSSL Wildcard Renewal Checklist
Validity is now capped at 199 days as of March 12, 2026, so renewal happens roughly twice a year instead of once. Check each item before triggering reissuance.
dig CAA example.com)Security Risks of Using a Wildcard Certificate
The structural trade-off behind every wildcard certificate: one private key secures every subdomain it is deployed to.
This risk scales with how widely the key is distributed. A wildcard deployed to a single server behind a single load balancer carries modest exposure. The same wildcard's key copied across a dozen edge nodes, several CDN configurations, and multiple environments multiplies the number of places a compromise could originate, while the consequence stays the same regardless of where the breach occurred.
*.example.com rather than named subdomains, Certificate Transparency logs show only the pattern. Individual certificates for internal-admin.example.com or staging.example.com expose those exact hostnames permanently in a public, searchable log.PositiveSSL Wildcard vs. Alternatives
Three comparisons that actually matter for most buyers making this purchase decision.
The comparison that actually matters for most buyers — a real free-vs-paid decision rather than a choice between similar paid products.
PositiveSSL Wildcard
Let's Encrypt Wildcard
The closest direct competitor in both price and validation tier. Practical differences are narrow.
PositiveSSL Wildcard
AlphaSSL Wildcard
This comparison is really a DV-vs-OV decision wearing a brand-name disguise. GeoTrust and DigiCert charge 3x to 10x more, and the jump buys two specific things: a substantially larger warranty and business identity verification.
PositiveSSL Wildcard
GeoTrust / DigiCert Wildcard
Key Changes for Wildcard Certificates in 2026
The same CA/Browser Forum-driven changes affecting every public certificate apply to PositiveSSL Wildcard, but with one specific consequence for wildcard deployments worth calling out separately.
| Change | Detail | Impact on Wildcards Specifically |
|---|---|---|
| Shorter validity | Maximum validity dropped to 199 days as of March 12, 2026 | Renewal now has to be coordinated and redeployed everywhere the key lives roughly twice a year. Missing one instance leaves that server serving an outdated certificate until caught. |
| Shorter DCV reuse | Domain Control Validation can only be reused for up to 198 days | The underlying domain check must be repeated more frequently too. DNS zone access needs to be reliably available before each renewal cycle. |
Should You Buy PositiveSSL Wildcard?
For SaaS products and agencies managing a single brand domain with growing subdomain sprawl above five first-level subdomains, the wildcard's single renewal cycle and automatic coverage of new subdomains earn their higher price. For nested architectures or strict isolation requirements, per-service ACME automation addresses the actual need more directly.
Buy It If
- The domain runs five or more first-level subdomains on a flat structure
- DNS zone access is available to whoever manages the certificate
- No business identity verification (OV or EV) is required
- New subdomains are added regularly and manual reissuance is impractical
Skip It If
- Subdomain count is below five and individual DV certs would be cheaper
- The subdomain structure is nested rather than flat
- Isolating a key compromise to a single service matters more than renewal convenience
- ACME automation is already in place and Let's Encrypt is free
Frequently Asked Questions
Ready to Compare SSL Certificates?
PositiveSSL Wildcard suits domains with five or more subdomains on a flat structure. Use our comparison table to see all wildcard options side by side.
