Compare Items
Please, add items to this compare group or choose not empty group
PositiveSSL Multi-Domain Wildcard (DV) Review 2026 | CompareCheapSSL

PositiveSSL Multi-Domain Wildcard (DV) Review 2026

Sectigo's cheapest path to multi-domain coverage with wildcard subdomain support, sold through resellers including CheapSSLWeb, PositiveSSL.com, and Certera. Here is how the SAN structure actually works, what resellers differ on, and when the OV version justifies the higher price.

Issues in minutes with no business documents, phone calls, or address verification
Combines flat domain SAN entries with wildcard SANs covering unlimited subdomains per base domain
New subdomains under listed base domains are covered automatically without reissuance
!Base price includes 1 wildcard domain only — additional wildcard SANs cost extra above that
Domain Validation (DV) From $29.99/yr Issues in minutes
CompareCheapSSL
Our Verdict
3.9
out of 5 ★★★★☆
ValidationDV (Domain Only)
IssuanceMinutes
From$29.99/yr
Wildcard base1 included, more extra
Validity200 days
Business IDNone

What It Secures

PositiveSSL Multi-Domain Wildcard combines two SAN types in a single certificate: standard domain entries for named flat domains, and wildcard entries for domains where unlimited subdomain coverage is needed. A base package from most resellers includes one wildcard SAN covering one base domain and all its first-level subdomains, with additional standard or wildcard SANs purchasable on top.

Because this is domain-validated, Sectigo checks nothing about the business behind the domains — only that whoever requests the certificate controls each one. No documents, no phone calls, and no address verification at any stage.

ℹ️
Wildcard and standard SANs mix freely: A single certificate can carry a mix of wildcard entries like *.example.com and standard entries like shop.otherbrand.com on the same certificate, which is what separates this product from a plain wildcard certificate that covers only one base domain.
How the SAN Structure Works

Understanding Wildcard vs. Standard SAN Slots

The single most common confusion with this certificate is around what counts as a SAN slot and what gets covered automatically. Each wildcard SAN entry costs more than a standard SAN, and the two are not interchangeable within the same pricing structure.

What each SAN type covers and costs

One wildcard SAN (e.g. *.example.com) — covers example.com and every first-level subdomain like shop.example.com, api.example.com, and any future onesHigher rate
One standard SAN (e.g. otherbrand.com) — covers that domain and its www version only, no subdomainsLower rate
Bare root domain (example.com) when requesting *.example.com — covered automatically as part of the wildcard entry, not a separate slotIncluded
Second-level subdomain (e.g. staging.api.example.com) — outside the wildcard's one-level scope regardless of other SANs on the certificateNot covered
📋
Total domain ceiling varies by reseller: PositiveSSL.com lists up to 100 total domains; CheapSSLWeb lists up to 250. This discrepancy on the identical certificate is real and worth confirming with the specific seller before scaling past 100 domains.

How Domain Validation Works

Domain validation for each SAN entry — both wildcard and standard — runs through email confirmation or a DNS/file-based method, with no manual review step. Most resellers quote issuance in minutes from order completion, assuming immediate access to domain verification.

1
Minutes per domain

Domain Control Confirmation

Email, DNS record, or file upload per base domain. Wildcard entries validate control of the base domain, not each individual subdomain separately. Once the base domain is validated, every current and future subdomain it contains is covered.

2
Minutes

Automatic Issuance

Certificate issues automatically once every listed domain entry completes domain control confirmation. No manual CA review, no queuing, and no business paperwork required at any point.

💡
Reissue adds subdomains free: Adding a new subdomain under a domain already covered by a wildcard SAN on this certificate requires no reissuance and no additional cost. The coverage extends automatically without any action on the certificate holder's side.

Certificate Specifications

Key Length
2048-bit RSA (ECC supported)
Encryption Strength
Up to 256-bit
Root Chain
USERTrust RSA (Sectigo)
Validation Type
Domain Validation (DV)
Base Wildcard SANs
1 (covers base + all subdomains)
Issuance Time
Minutes
Site Seal
Static, brand mark only
Server Licensing
Unlimited
Max Validity (2026)
200 days
📋
What "ECC supported" means in practice: On some reseller listings, an elliptic curve key option appears during ordering, which is technically correct — Sectigo can issue this certificate with ECC. However, several older servers and mail clients have limited ECC support, so RSA remains the safer default for mixed-environment deployments.

What It Actually Costs

Pricing here reflects three variables that do not always move together: the headline certificate price, how many additional wildcard SANs are included, and the total domain ceiling. A lower per-year rate does not always mean a lower total cost once per-SAN add-on fees are factored in.

CHEAPEST
CheapSSLWeb
$29.99/yr
1 wildcard + 2 standard SANs included, up to 250 total advertised
GeoCerts
$47.40/yr
1 wildcard SAN, additional SANs prorated by remaining term
Certera
$49.99/yr
1 wildcard + 2 standard SANs, further SANs purchasable
PositiveSSL.com
$80/yr
Official store. 1 wildcard SAN, up to 100 total advertised
💡
Wildcard SAN add-on cost is often higher than the base price suggests. Each additional wildcard SAN entry costs more than a standard SAN at most sellers. If the deployment needs several wildcard SANs, compare total cost across resellers rather than just the headline package price.

Key Changes for 2026

The same CA/Browser Forum validity change affecting every publicly trusted certificate applies here, with an additional note specific to wildcard deployments in mixed-environment configurations.

1

200-Day Maximum Validity per Issuance

Effective March 8, 2026, every new or reissued certificate from Sectigo, including this product, carries a 200-day maximum validity regardless of subscription length. Multi-year subscriptions still bill across multiple years but require reissuance roughly twice annually. For wildcard deployments spanning multiple servers or environments, reissuance needs to reach every location the certificate is installed, since a stale copy on one server produces browser warnings independently of how the others are configured.

2

Shorter Domain Validation Reuse

Domain Control Validation results are reusable for a shorter window than before, meaning domain verification needs repeating more frequently across all base domains on the certificate. For deployments with several wildcard SANs across different DNS zones, planning a consistent revalidation routine before the first renewal cycle arrives reduces the risk of partial reissuance failures.

Where It Wins and Loses

Where It Wins

  • Fastest, lowest-cost path to wildcard subdomain coverage across multiple domains
  • Issues in minutes with no business verification overhead whatsoever
  • Wildcard and standard SAN entries mix freely on the same certificate
  • New subdomains under wildcard-covered base domains are protected automatically at no added cost
  • Unlimited server licensing across every server hosting the covered domains

Where It Loses

  • No business identity verification — cannot display an organization name in the certificate or site seal
  • Static, non-clickable site seal carries no trust signal beyond a brand mark
  • Domain ceiling conflicts across resellers from 100 to 250 for the identical certificate
  • Second-level subdomains are outside scope regardless of wildcard SANs on the certificate
  • Not appropriate for any domain processing payment data or handling sensitive information

DV vs. OV Multi-Domain Wildcard: When to Upgrade

Both certificates share the same wildcard SAN mechanism, the same encryption, and the same server licensing. The difference comes down to business identity verification and what that verification costs in time and money.

PositiveSSL MDW (DV) — this page

ValidationDomain control only
IssuanceMinutes
Site sealStatic, no org name
Typical price$29.99 to $80/yr
Best forFast, low-risk multi-domain with growing subdomains

Comodo MDW SSL (OV)

ValidationDomain + business registration
Issuance1 to 3 business days
Site sealDynamic, shows org name
Typical price$210 to $265/yr
Best forBusiness-facing multi-domain with visible identity
💡
The price gap is meaningful: OV Multi-Domain Wildcard costs roughly seven times more than the cheapest DV listing for this product. That premium buys business verification and a dynamic site seal, which matters on customer-facing domains and is largely irrelevant for internal tools, staging environments, and low-risk public sites.

Ideal Use Cases

Good fit

SaaS Products with Growing Subdomain Structures

Platforms that generate customer subdomains over time benefit from wildcard coverage that scales automatically without per-subdomain SAN purchases across multiple brand domains.

Good fit

Agencies Managing Low-Risk Client Sites

Portfolios of informational or content sites where rapid deployment matters more than business identity verification benefit from the minutes-fast issuance at low per-domain cost.

Good fit

Mixed Flat and Subdomain Domain Portfolios

Deployments needing both named flat domains and wildcard coverage across others benefit from the certificate's ability to mix standard and wildcard SANs freely in one bundle.

Consider alternatives

Customer-Facing Commerce or Login Domains

DV carries no business identity verification. Any domain collecting payment data or account credentials should use OV or EV instead.

Consider alternatives

Deployments with Nested Subdomain Structures

Second-level subdomains like staging.api.example.com are outside the wildcard scope. Deeply nested hostnames need a different certificate structure.

Consider alternatives

Deployments Planning to Scale Past 100 Domains

Given the 100 vs 250 ceiling conflict across resellers, confirm the actual cap with the specific seller before planning a large-scale rollout that depends on the higher figure.

Frequently Asked Questions

Most base packages include one wildcard SAN and two additional standard SAN slots for three covered domains total. Each further wildcard SAN costs extra on top of the base price, at a higher per-entry rate than standard SANs. Confirm the specific inclusion with the reseller before assuming multiple wildcard SANs are bundled.
Resellers disagree. PositiveSSL.com and Namecheap advertise a ceiling around 100, while CheapSSLWeb and ComodoSSLStore advertise up to 250 for the same underlying certificate. Confirm the actual cap with the specific seller before planning a deployment near either limit.
No. A wildcard SAN covers exactly one subdomain level beneath the base domain. Second-level subdomains require a separate wildcard for that specific branch or a standard SAN listing each hostname individually.
None. This certificate validates domain control only, through email confirmation or DNS/file-based methods. No business registration, address, or telephone verification occurs at any stage. Issuance completes in minutes as a result.
Yes. Standard domain entries covering a single named domain and wildcard entries covering unlimited subdomains under a base domain can both appear on the same certificate. The two SAN types are priced differently per entry, and each one is validated separately during issuance.
A maximum of 200 days per issuance under the CA/Browser Forum cap effective March 8, 2026. Multi-year subscriptions still bill across multiple years but require reissuance roughly twice annually. Every server and environment hosting the certificate needs to receive the reissued file for the coverage to remain uninterrupted.

Ready to Compare SSL Certificates?

PositiveSSL Multi-Domain Wildcard offers the cheapest path to wildcard coverage across multiple domains, at the cost of business identity verification. Compare it against the OV version and other Sectigo multi-domain products to find the right fit.