How to Install and Manage a Free SSL Wildcard Certificate in cPanel

A wildcard SSL certificate (e.g. covering *.yourdomain.com) secures the bare domain plus every subdomain with a single certificate, instead of needing a fresh certificate every time you add shop., mail., or staging. in front of your domain.

Why AutoSSL usually doesn’t cover this

cPanel’s free AutoSSL (domain-validated, via Sectigo/Let’s Encrypt) issues certificates per hostname it can validate over HTTP, and by default does not issue a true wildcard certificate — Let’s Encrypt’s wildcard issuance specifically requires DNS-based validation (a TXT record), not the simpler HTTP validation AutoSSL uses by default.

Getting a wildcard certificate via DNS validation

If your DNS is hosted somewhere that supports it (or your cPanel/DNS provider has ACME DNS integration), some setups can issue Let’s Encrypt wildcards automatically through a DNS-01 challenge plugin. Where that isn’t available, the manual path is:

1. Generate a CSR for *.yourdomain.com under SSL/TLS > Generate a Certificate Signing Request.
2. Use that CSR with a certificate authority that issues wildcard certificates (a paid wildcard cert, or a Let’s Encrypt client capable of DNS-01 challenges run outside cPanel).
3. Add the required DNS TXT record the CA gives you, to prove you control the domain.
4. Once issued, install the certificate, private key and CA bundle under SSL/TLS > Install and Manage SSL for your site, same as any manually-issued certificate.

Is a wildcard worth it for you?

If you only have a handful of subdomains, AutoSSL issuing (and auto-renewing) individual certificates per subdomain is simpler and completely free with no DNS-01 setup required. A wildcard earns its complexity when you’re spinning up new subdomains frequently (client staging sites, per-customer subdomains) and don’t want to wait for a new certificate each time.

Renewal

Unlike AutoSSL’s fully automatic renewal, a manually-issued wildcard certificate needs its own renewal process tracked — mark the expiry date somewhere you’ll actually see it, since a wildcard covers many hostnames at once and expiry breaks all of them simultaneously.