CertOneAlongside identity validation levels, choose which names the certificate should cover. Single-domain, multi-domain, and wildcard certificates offer different management and cost trade-offs. This guide explains how to choose.
1. Single-domain certificates
1. Definition
A single-domain certificate covers one fully qualified hostname. A certificate for www.example.com does not automatically cover example.com or other subdomains.
2. Characteristics
Advantages:
- ✅ Often inexpensive, with free options available
- ✅ Simple issuance and configuration
- ✅ Suitable for one hostname
Limitations:
- ❌ Covers only the specified name
- ❌ Multiple names require separate certificates or a different coverage type
- ❌ Multiple certificates create more renewal tasks
3. Use cases
- Personal blogs
- Simple business websites
- Sites needing only one hostname
- Development and test environments
4. Example
Certificate name: www.example.com
Coverage:
✅ www.example.com
❌ example.com
❌ api.example.com
❌ blog.example.com
2. Multi-domain (SAN) certificates
1. Definition
A multi-domain certificate lists several names in its SAN extension. These can be related subdomains or unrelated domains.
2. Characteristics
Advantages:
- ✅ One certificate for several names
- ✅ Covers unrelated domains
- ✅ One renewal replaces the full set
- ✅ Names can be changed by reissuing the certificate
Limitations:
- ❌ Paid products may cost more than single-domain certificates
- ❌ Names are disclosed together; key compromise affects every covered name
- ❌ Adding a name requires reissuance
3. Use cases
- Organizations with multiple domains
- Protect an apex domain and several subdomains
- Separate API and web hostnames
- Separate mobile and desktop hostnames
4. Example
Primary certificate name: example.com
SAN entries:
✅ example.com
✅ www.example.com
✅ api.example.com
✅ blog.example.com
✅ shop.example.com
Unrelated domains can also be included:
Primary certificate name: example.com
SAN entries:
✅ example.com
✅ example.net
✅ example.org
✅ another-domain.com
5. SAN extension
Subject Alternative Name is an X.509 extension listing the names covered by a certificate. Modern TLS clients use it for hostname validation.
3. Wildcard certificates
1. Definition
A wildcard such as *.example.com covers matching names at one level, including www.example.com, api.example.com, and blog.example.com. It does not cover the apex example.com or deeper names such as sub.www.example.com unless they are separately listed.
2. Characteristics
Advantages:
- ✅ Covers matching subdomains at one level
- ✅ New matching subdomains need no reissuance
- ✅ One certificate to manage
- ✅ Useful for many subdomains
Limitations:
- ❌ Commercial wildcard products may cost more; the original comparison cites 2–3 times single-domain pricing
- ❌ The apex must be included separately
- ❌ One wildcard does not cover deeper subdomain levels
- ❌ Key compromise affects all names using the certificate
3. Use cases
- Sites with many subdomains
- SaaS services assigning one subdomain per customer
- Multi-tenant applications
- Frequently created subdomains
4. Example
Certificate name: *.example.com
Coverage:
✅ www.example.com
✅ api.example.com
✅ blog.example.com
✅ shop.example.com
✅ admin.example.com
✅ Any matching first-level subdomain
❌ example.com (apex not covered by the wildcard)
❌ sub.www.example.com (deeper name not covered)
Note: include the apex as a separate SAN if you need both the apex and wildcard coverage, or use a certificate listing the required names.
4. Comparison
1. Feature comparison
| Feature | Single-domain | Multi-domain | Wildcard |
|---|---|---|---|
| Names covered | One | Multiple, subject to CA limits | Matching names at one level |
| Apex | ✅ If specified | ✅ If included | ❌ Add separately |
| Subdomains | Only the specified name | Explicitly listed names | Matching first-level names |
| New name | New certificate | Reissuance | No change if already matched |
| Commercial pricing | Usually lower | Product-dependent | Often higher; free options exist |
2. Historical price examples
| Type | Original annual price range | Notes |
|---|---|---|
| Single-domain | Free–RMB 500 | Free options available |
| Multi-domain | RMB 500–3,000 | Paid prices may scale with name count |
| Wildcard | RMB 1,000–5,000 | Commercial example only; free issuance also exists |
3. Management comparison
| Feature | Single-domain | Multi-domain | Wildcard |
|---|---|---|---|
| Certificate count | One per name | One for the set | One for matching names |
| Renewal workload | Multiple certificates | One certificate | One certificate |
| Configuration complexity | Moderate | Moderate | Often simpler for matching subdomains |
| Management overhead | Higher for many names | Lower inventory count | Lower inventory count |
5. Choosing coverage
1. Number of names
One hostname:
- Option: single-domain certificate
- Reason: straightforward configuration and low cost
2–10 distinct names:
- Option: multi-domain certificate
- Reason: one certificate to manage
Many subdomains:
- Option: wildcard certificate
- Reason: covers matching subdomains with one certificate
2. Name patterns
Apex and a few fixed subdomains:
- Option: multi-domain certificate
- Example: example.com, www.example.com, api.example.com
Apex and many dynamic subdomains:
- Option: wildcard plus an explicit apex SAN
- Example: *.example.com and example.com
Unrelated domains:
- Option: multi-domain certificate
- Example: example.com, example.net, another-site.com
3. Budget
Limited budget:
- Option: free or low-cost single-domain certificates
- Consider a free multi-domain certificate for several names
Moderate budget:
- Options: multi-domain or wildcard
- Choose according to name coverage
Larger budget:
- Options: wildcard or multi-domain
- Prioritize manageable operations
4. Business needs
Stable hostname list:
- Options: single-domain or multi-domain
Frequently added subdomains:
- Option: wildcard certificate
SaaS with one subdomain per customer:
- Option: wildcard certificate
Multiple brands on unrelated domains:
- Option: multi-domain certificate
6. Combined deployments
Different certificate types can coexist:
1. Apex plus wildcard
Approach: a certificate for example.com plus a wildcard certificate for *.example.com.
Benefit: covers the apex and matching subdomains.
Use case: an apex with many subdomains.
2. Multi-domain plus wildcard
Approach: explicitly cover the apex and critical names with one certificate, and use a separate wildcard certificate for other matching subdomains.
Benefit: separate key management for critical names while simplifying the remaining inventory.
Use case: important services with distinct key-isolation requirements.
7. Request considerations
1. Single-domain certificates
- Identify the exact names needed: www.example.com and example.com are distinct
- Use a certificate covering both if both are required
2. Multi-domain certificates
- Plan the name list in advance
- Check the CA's per-certificate limit
- Adding a name requires a new certificate
3. Wildcard certificates
- Remember that a wildcard matches one level
- Include the apex explicitly if needed
- Protect shared private keys carefully; compromise affects every service using them
8. Examples
Example 1: Personal blog
Requirement: www.example.com
Choice: free single-domain DV certificate
Reason: one hostname needs coverage.
Example 2: Small business
Requirement: example.com, www.example.com, api.example.com
Choice: a three-name multi-domain certificate
Reason: a small, stable name list is easy to manage together.
Example 3: SaaS
Requirement: the apex and customer subdomains such as client1.example.com and client2.example.com
Choice: *.example.com with example.com included separately
Reason: matching customer names can be added without reissuance.
Example 4: Large organization
Requirement: multiple brand domains and many subdomains
Choice: multi-domain certificates for brand names and separate wildcard certificates where appropriate
Reason: combine coverage types to fit the deployment and key-isolation requirements.
Conclusion
Choose coverage according to the number and pattern of names, budget, and operational requirements.
- Single-domain certificates: Suitable for protecting one domain, typically at the lowest cost.
- Multi-domain certificates: Convenient for managing a fixed set of domains.
- Wildcard certificates: Flexible coverage for many subdomains at the same level.
Consider the number of domains, business requirements, budget, and administrative effort when selecting a certificate. Complex deployments can combine certificate types. Whichever type you choose, configure it correctly and renew it on time.