PositiveSSL Multi-Domain Wildcard (DV) Review 2026
Sectigo's cheapest path to multi-domain coverage with wildcard subdomain support, sold through resellers including CheapSSLWeb, PositiveSSL.com, and Certera. Here is how the SAN structure actually works, what resellers differ on, and when the OV version justifies the higher price.
What It Secures
PositiveSSL Multi-Domain Wildcard combines two SAN types in a single certificate: standard domain entries for named flat domains, and wildcard entries for domains where unlimited subdomain coverage is needed. A base package from most resellers includes one wildcard SAN covering one base domain and all its first-level subdomains, with additional standard or wildcard SANs purchasable on top.
Because this is domain-validated, Sectigo checks nothing about the business behind the domains — only that whoever requests the certificate controls each one. No documents, no phone calls, and no address verification at any stage.
Understanding Wildcard vs. Standard SAN Slots
The single most common confusion with this certificate is around what counts as a SAN slot and what gets covered automatically. Each wildcard SAN entry costs more than a standard SAN, and the two are not interchangeable within the same pricing structure.
What each SAN type covers and costs
How Domain Validation Works
Domain validation for each SAN entry — both wildcard and standard — runs through email confirmation or a DNS/file-based method, with no manual review step. Most resellers quote issuance in minutes from order completion, assuming immediate access to domain verification.
Domain Control Confirmation
Email, DNS record, or file upload per base domain. Wildcard entries validate control of the base domain, not each individual subdomain separately. Once the base domain is validated, every current and future subdomain it contains is covered.
Automatic Issuance
Certificate issues automatically once every listed domain entry completes domain control confirmation. No manual CA review, no queuing, and no business paperwork required at any point.
Certificate Specifications
What It Actually Costs
Pricing here reflects three variables that do not always move together: the headline certificate price, how many additional wildcard SANs are included, and the total domain ceiling. A lower per-year rate does not always mean a lower total cost once per-SAN add-on fees are factored in.
Key Changes for 2026
The same CA/Browser Forum validity change affecting every publicly trusted certificate applies here, with an additional note specific to wildcard deployments in mixed-environment configurations.
200-Day Maximum Validity per Issuance
Effective March 8, 2026, every new or reissued certificate from Sectigo, including this product, carries a 200-day maximum validity regardless of subscription length. Multi-year subscriptions still bill across multiple years but require reissuance roughly twice annually. For wildcard deployments spanning multiple servers or environments, reissuance needs to reach every location the certificate is installed, since a stale copy on one server produces browser warnings independently of how the others are configured.
Shorter Domain Validation Reuse
Domain Control Validation results are reusable for a shorter window than before, meaning domain verification needs repeating more frequently across all base domains on the certificate. For deployments with several wildcard SANs across different DNS zones, planning a consistent revalidation routine before the first renewal cycle arrives reduces the risk of partial reissuance failures.
Where It Wins and Loses
Where It Wins
- Fastest, lowest-cost path to wildcard subdomain coverage across multiple domains
- Issues in minutes with no business verification overhead whatsoever
- Wildcard and standard SAN entries mix freely on the same certificate
- New subdomains under wildcard-covered base domains are protected automatically at no added cost
- Unlimited server licensing across every server hosting the covered domains
Where It Loses
- No business identity verification — cannot display an organization name in the certificate or site seal
- Static, non-clickable site seal carries no trust signal beyond a brand mark
- Domain ceiling conflicts across resellers from 100 to 250 for the identical certificate
- Second-level subdomains are outside scope regardless of wildcard SANs on the certificate
- Not appropriate for any domain processing payment data or handling sensitive information
DV vs. OV Multi-Domain Wildcard: When to Upgrade
Both certificates share the same wildcard SAN mechanism, the same encryption, and the same server licensing. The difference comes down to business identity verification and what that verification costs in time and money.
PositiveSSL MDW (DV) — this page
Comodo MDW SSL (OV)
Ideal Use Cases
SaaS Products with Growing Subdomain Structures
Platforms that generate customer subdomains over time benefit from wildcard coverage that scales automatically without per-subdomain SAN purchases across multiple brand domains.
Agencies Managing Low-Risk Client Sites
Portfolios of informational or content sites where rapid deployment matters more than business identity verification benefit from the minutes-fast issuance at low per-domain cost.
Mixed Flat and Subdomain Domain Portfolios
Deployments needing both named flat domains and wildcard coverage across others benefit from the certificate's ability to mix standard and wildcard SANs freely in one bundle.
Customer-Facing Commerce or Login Domains
DV carries no business identity verification. Any domain collecting payment data or account credentials should use OV or EV instead.
Deployments with Nested Subdomain Structures
Second-level subdomains like staging.api.example.com are outside the wildcard scope. Deeply nested hostnames need a different certificate structure.
Deployments Planning to Scale Past 100 Domains
Given the 100 vs 250 ceiling conflict across resellers, confirm the actual cap with the specific seller before planning a large-scale rollout that depends on the higher figure.
Frequently Asked Questions
Ready to Compare SSL Certificates?
PositiveSSL Multi-Domain Wildcard offers the cheapest path to wildcard coverage across multiple domains, at the cost of business identity verification. Compare it against the OV version and other Sectigo multi-domain products to find the right fit.
