Detailed Process For Implementing SSL On Multiple Subdomains Using Wildcard Certificates

Published On - September 24, 2025

Olivia Brown Blog

So, you’ve built a cool website and now you want to make it secure. That little lock in the browser bar? That’s SSL in action. But what if you have lots of subdomains like blog.yoursite.com, shop.yoursite.com, and login.yoursite.com? That’s where wildcard SSL certificates come in to save the day!

Let’s break it all down in a fun, simple, and straightforward way.

🔐 What is SSL?

SSL stands for Secure Sockets Layer. It encrypts data between the user’s browser and your web server. That means people can browse your site without fear of anyone “listening in.”

Nowadays, we technically use TLS (Transport Layer Security), but most people still call it SSL. Tomato, to-mah-to.

🌟 What’s a Wildcard Certificate?

A wildcard SSL certificate secures one domain and all its subdomains. That includes unlimited subdomains at one level.

For example, a wildcard cert for *.example.com covers:

  • www.example.com
  • store.example.com
  • mail.example.com
  • anything-you-want.example.com

But it does not cover sub.sub.example.com. Only one subdomain level.

🚀 Why Use a Wildcard Certificate?

Good question! Here are some solid reasons:

  • Cost-effective: One certificate for multiple subdomains. Boom!
  • Time-saving: Renew or install one cert instead of many.
  • Easy to manage: Track and maintain a single certificate.

Sounds good? Now let’s get to the juicy part—how to actually implement it!

🛠️ Step-by-Step Implementation

Step 1: Purchase a Wildcard SSL Certificate

Go to a trusted Certificate Authority (CA) like:

  • Let’s Encrypt (free)
  • GoDaddy
  • Comodo
  • DigiCert

When buying, use *.yourdomain.com as the domain. The * is your wildcard.

Heads up: For Let’s Encrypt, you’ll need a DNS challenge for wildcard support.

Step 2: Generate a Certificate Signing Request (CSR)

Depending on your server, generate a CSR. Here’s a basic example for Apache with OpenSSL:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.com.key -out yourdomain.com.csr

It’ll ask you for info like:

  • Country
  • Organization
  • Email
  • Most importantly: Common Name = *.yourdomain.com

Keep that private key file safe!

Step 3: Complete Domain Validation

Your CA will ask you to prove you own the domain. Usually via:

  • DNS record: Add a TXT entry.
  • Email: Reply to a validation email.

If you’re using Let’s Encrypt, this is where the DNS-01 challenge comes into play.

Step 4: Get and Download Your Certificate

Once validated, your CA will issue the certificate files. What you usually get:

  • Your certificate (.crt)
  • CA Bundle (.ca-bundle)
  • Your private key (from the CSR step)

Now it’s install time! 🎉

Step 5: Install on Your Server

This is different for each server. Let’s cover the basics for Apache and Nginx.

Apache Example:

SSLEngine on
SSLCertificateFile /etc/ssl/certs/yourdomain.com.crt
SSLCertificateKeyFile /etc/ssl/private/yourdomain.com.key
SSLCertificateChainFile /etc/ssl/certs/CA-bundle.crt

Restart Apache:

sudo systemctl restart apache2

Nginx Example:

server {
  listen 443 ssl;
  server_name *.yourdomain.com;
  ssl_certificate /etc/ssl/certs/yourdomain.com.crt;
  ssl_certificate_key /etc/ssl/private/yourdomain.com.key;
}

Restart Nginx:

sudo systemctl restart nginx

Done! Now try accessing your subdomains via HTTPS. Shiny! 🔒

📁 Step 6: Use Across Multiple Subdomains

Once installed, the same cert can be used across all of your subdomains hosted on the same server or even different servers, as long as you share the private key and cert files. Just copy them over securely.

Make sure all your servers support the same TLS version. Also, keep those secure files out of public directories!

🔄 BONUS Tip: Automate Renewal!

If you’re using Let’s Encrypt, certs only last 90 days. But you can automate renewal using tools like:

  • Certbot
  • acme.sh
  • SSL For Free

Set a cron job for peace of mind:

0 0 * * 1 /usr/bin/certbot renew >> /var/log/ssl-renew.log

If you’re using a paid CA, they’ll usually email you well before expiry. Don’t let that cert die!

🕵️ Check If It’s Working

Visit your secured subdomain. Make sure you get the lock icon.

You can also test with tools:

If you see green checks and no red flags—you nailed it!

📌 Common Gotchas

Watch out for these:

  • Mismatched common name: Always use *.yourdomain.com
  • Wrong file path: Check for typos
  • Wrong permission: Private key should be readable by root only
  • Forget to restart server: Make changes take effect!

🎉 That’s a Wrap!

Implementing SSL across multiple subdomains is no longer rocket science. With a wildcard certificate, it’s actually quite fun and efficient.

Just remember:

  • Buy from a good CA
  • Use the right CSR settings
  • Securely install and test
  • Create backups
  • Renew on time

Your users will thank you. And Google? They’ll give you some SEO love too!

Happy securing! 🔐🌐