Pros and Cons of Wildcard SSL Certificates – Explained by SSL Security Experts

Wildcard SSL certificates are incredibly versatile SSL certificates. A wildcard certificate is the SSL/TLS certificate that is capable of securing a single domain and all of its subdomains at a designated level. They’re a great fit for smaller companies and shared hosting environments, but there are some drawbacks to using them, too. That’s why, in this article, we’ll explain what wildcard SSL certificates are, how they work, and what the pros and cons of wildcard SSL certificates are.

What is a Wildcard SSL Certificate?

Wildcard SSL certificates work just like any other kind of SSL certificate, but with one key distinction: Wildcards can also encrypt an unlimited number of subdomains on a single level. A subdomain is the portion of the URL that is right in front of the domain name. Things like:

• mail.website.com
• login.website.com
• ftp.website.com

Normally, you’d need to secure each of those subdomains individually, which can get expensive — especially as you add more and more. A single wildcard certificate can encrypt all of them (on a single level) at once. It’s a huge time saver and, if you ever add a subdomain (even after the wildcard was issued), the certificate can be installed on the new subdomain, too.

How Does It Work?

As we mentioned, wildcard SSL certificates function the same as other SSL certificates in many ways, but when you’re generating the certificate signing request (CSR), rather than listing out the domain explicitly, you place a wildcard character (*) at the sub-domain level you’re encrypting. When the certificate authority (CA) issues the wildcard, you’ll be able to install it on any subdomain that resides on that level of the URL.

So, what are the pros and cons of wildcard SSL certificates? Let’s break them down individually.

The Advantages of Wildcard SSL Certificates

The biggest advantages of wildcard SSL are:

• Cost savings in terms of both certificate purchases and management
• Ease of certificate management
• Future-proofing your website

The Disadvantages of Wildcard SSL Certificates

There are a few disadvantages to wildcard SSL certificates. For one, they’re not available at all validation levels. You can get wildcards at domain validation (DV) and organization validation (OV), but not extended validation (EV). This means that if you want to slap an EV certificate on a subdomain, you’ll have to use single certificates or multi-domain certificates.

Second, there’s a common misconception that wildcards secure all subdomains. That’s only partially true; these certificates secure all subdomains at the designated URL level. There are multiple subdomain levels. As you go up, URLs branch. This adds complexity. Wildcards are much more difficult to deploy on second- and third-level subdomains. A better route would be to use a multi-domain SSL certificate in those contexts.

Third, the more domains and subdomains you have a key pair installed on, the more attack surface criminals have to play with. Using parallel attacks that launch requests across all the endpoints using that key pair, there have been exploits demonstrated that can compromise private keys. That’s a disaster in terms of SSL/TLS.

Our fourth and final point is that when the key gets compromised on one domain or subdomain, it’s now compromised on all of the subdomains and domains it’s installed on. That amplifies your problems.

To answer your question, “Are wildcard certificates less secure?” the answer is yes. Wildcard certificates are less secure because of the wider domain available for the attack.

Wildcard SSL certificate limitations are as follows:

1. Wildcard certificates are not available at the extended verification (EV) level.
2. Wildcard certificates are difficult to deploy on second and third level subdomains.
3. If one of the domains or subdomains is hacked, the criminal can easily get to all the other subdomains.
4. Risk of parallel attacks on all the endpoints.

At CheapSSLSecurity.com, we sell wildcard SSL certificates for less than anyone on the internet. But from a security standpoint, we’d suggest using multi-domain certificates, which can be configured to be more secure.