A wildcard SSL certificate (e.g. covering *.yourdomain.com) secures the bare domain plus every subdomain with a single certificate, instead of needing a fresh certificate every time you add shop., mail., or staging. in front of your domain.
Why AutoSSL usually doesn’t cover this
cPanel’s free AutoSSL (domain-validated, via Sectigo/Let’s Encrypt) issues certificates per hostname it can validate over HTTP, and by default does not issue a true wildcard certificate — Let’s Encrypt’s wildcard issuance specifically requires DNS-based validation (a TXT record), not the simpler HTTP validation AutoSSL uses by default.
Getting a wildcard certificate via DNS validation
If your DNS is hosted somewhere that supports it (or your cPanel/DNS provider has ACME DNS integration), some setups can issue Let’s Encrypt wildcards automatically through a DNS-01 challenge plugin. Where that isn’t available, the manual path is:
- Generate a CSR for
*.yourdomain.comunder SSL/TLS > Generate a Certificate Signing Request. - Use that CSR with a certificate authority that issues wildcard certificates (a paid wildcard cert, or a Let’s Encrypt client capable of DNS-01 challenges run outside cPanel).
- Add the required DNS TXT record the CA gives you, to prove you control the domain.
- Once issued, install the certificate, private key and CA bundle under SSL/TLS > Install and Manage SSL for your site, same as any manually-issued certificate.
Is a wildcard worth it for you?
If you only have a handful of subdomains, AutoSSL issuing (and auto-renewing) individual certificates per subdomain is simpler and completely free with no DNS-01 setup required. A wildcard earns its complexity when you’re spinning up new subdomains frequently (client staging sites, per-customer subdomains) and don’t want to wait for a new certificate each time.
Renewal
Unlike AutoSSL’s fully automatic renewal, a manually-issued wildcard certificate needs its own renewal process tracked — mark the expiry date somewhere you’ll actually see it, since a wildcard covers many hostnames at once and expiry breaks all of them simultaneously.