Which SSL Certificate Do I Need?

Which SSL certificate do I need? The short answer

Which SSL certificate do I need? The one that covers every hostname you serve over HTTPS, at the validation level your visitors expect. For one website, a domain validated certificate for a single domain is usually enough. Add a wildcard when you run many subdomains, a multi-domain (SAN) certificate when you run several domains, and organization or extended validation when people need to verify who is behind the site.

Every certificate type uses the same encryption strength. What you pay for is coverage (how many names) and validation (how much the certificate authority checks about you).

Key fact	Answer
First decision	Coverage: one name, one subdomain level, several domains, or both
Second decision	Validation: DV (domain control), OV (company checked), EV (extended checks)
Encryption	Identical across DV, OV and EV
Certificate lifetime	As of October 2026, max. 200 days per issued certificate (CA/Browser Forum ballot SC-081)
Who issues it	The certificate authority (DigiCert, Sectigo and their brands); BUY-SSL.com sells and supports it

What type of SSL certificate do I need? Two decisions

Most buyers get stuck because product names mix two separate choices. Split them and the decision gets simple. First choose the coverage type, then the validation level.

Decision 1: coverage – which names must the certificate protect?

A certificate only protects the hostnames written into it. List every name you serve over HTTPS, including www and any subdomains, before you shop.

Coverage type	Protects	Example	Best for
single-domain SSL	One hostname (often plus www)	example.com	One website, no extra subdomains
wildcard SSL certificates	All subdomains on one level	*.example.com	Many or changing subdomains of one domain
multi-domain (SAN) SSL	A list of named hostnames, across domains	example.com, example.net, shop.example.org	A fixed set of different domains
multi-domain wildcard SSL	Several domains, each with a wildcard	*.example.com, *.example.net	Several domains that each have many subdomains

Decision 2: validation – how much should the CA verify?

Validation decides what the certificate says about you, not how strongly it encrypts. domain validated (DV) SSL proves you control the domain and suits blogs, portfolios and most brochure sites. organization validated (OV) SSL adds checks on your company, and its name appears in the certificate details.

EV SSL certificates add the strictest identity checks under the CA/Browser Forum EV Guidelines. Browsers stopped showing a green EV address bar in 2019, so the company details now appear in the certificate viewer. For a full side-by-side of the three levels, read our DV vs OV vs EV comparison.

Do SSL certificates work for subdomains?

Yes, but only for the subdomains the certificate names. A certificate for example.com does not cover shop.example.com unless that subdomain is listed in it or a wildcard covers it. So an SSL certificate for a domain and subdomain needs either both names in a multi-domain certificate or a wildcard.

A wildcard (*.example.com) covers any subdomain on exactly one level, such as shop.example.com or blog.example.com. It does not cover a.b.example.com. Most CAs include the base domain, but this depends on the CA. If you are new to the concept, here is what a wildcard certificate is and how it matches names.

Hostname	Single-domain (example.com)	Wildcard (*.example.com)	Multi-domain (names listed)
example.com	Yes	Usually (CA-dependent)	If listed
www.example.com	Usually included	Yes	If listed
shop.example.com	No	Yes	If listed
api.eu.example.com	No	No (second level)	If listed
example.net	No	No	If listed

Subdomain SSL certificate: wildcard or listed names?

Choose a wildcard when you have many subdomains or add new ones often – you will not need to reissue the certificate each time. Choose a multi-subdomain SSL certificate (a multi-domain certificate with each subdomain listed) when the set is small and fixed. A listed certificate also limits exposure: if its key leaks, only the named hosts are affected, not every possible subdomain.

Tip: Count your names before you buy. Write out every hostname, including www variants and mail or API hosts, then match the list against the table above.

How many SSL certificates do I need for example.com, shop.example.com and example.net?

One multi-domain certificate that lists all three names (plus www variants) covers this setup on its own. If example.com will gain more subdomains, a wildcard for *.example.com plus a single-domain certificate for example.net – or one multi-domain wildcard – scales better.

Option	Certificates	Covers	Trade-off
A. Multi-domain	1	example.com, www, shop.example.com, example.net, www.example.net	One renewal; new subdomains need a reissue
B. Wildcard + single	2	*.example.com and example.net	Subdomains are open-ended; two renewals to track
C. Multi-domain wildcard	1	*.example.com and *.example.net	Most flexible; usually the highest-priced type
D. Three singles	3	Each name separately	Isolates each site; three orders and renewals

To compare cost, add up the live prices of each option’s components below. Remember that a multi-domain certificate usually includes a set number of names, and extra names are added per name.

Wildcard or multi-domain SSL: which is cheaper for 5 subdomains and 2 domains?

It depends on how the names are spread and whether they change. If all five subdomains sit under one domain and you expect more, a wildcard plus a small multi-domain or single-domain certificate for the second domain is usually the cheaper long-run setup. If the seven names are fixed, one multi-domain certificate with seven names is often simplest – compare the live totals.

Your setup	Best-fit choice	Why
1 domain, 1–2 fixed subdomains	Multi-domain, or single-domain if only www	Few names; no need for open-ended cover
1 domain, many or changing subdomains	Wildcard	New subdomains need no reissue
2–5 different domains, few subdomains	Multi-domain	One certificate, one renewal date
5 subdomains on one domain + 2 other domains	Wildcard + multi-domain, or one multi-domain with all names	Depends on growth; price both combinations
Several domains, each with many subdomains	Multi-domain wildcard	Wildcards for every listed domain in one certificate

Price comparisons only make sense with the same validation level and plan term on both sides. Compare DV with DV and a 1-year plan with a 1-year plan.

I need SSL for 3 domains, one with many subdomains, under $300 a year – what should I buy?

Start with two candidate setups and keep whichever fits your budget at current prices: a multi-domain wildcard covering all three domains, or a wildcard for the busy domain plus a multi-domain certificate for the other two. Both work with DV validation, which keeps cost down if you do not need company details in the certificate.

1. List every hostname per domain, including www, mail and API hosts.
2. Pick the validation level. DV unless clients or partners need to see your company in the certificate.
3. Price setup 1: one multi-domain wildcard with three domains.
4. Price setup 2: one wildcard for the domain with many subdomains + one multi-domain (or two single-domain) certificates for the rest.
5. Divide multi-year plan totals by years to compare against an annual budget.
6. Keep the cheaper setup that still covers every name – and leave room for growth.

The $300 figure here is your budget, not a BUY-SSL price. Live prices for the multi-domain wildcard category appear below so you can run the math today.

Which SSL certificate should I buy for my type of site?

Match your site to the closest row. Each row is a starting point, not a rule – your hostname list still decides the coverage type. When you have your shortlist, compare all SSL certificates side by side.

Site	Coverage	Validation	Note
Blog, portfolio, brochure site	Single-domain	DV	Simplest and lowest-priced path
Small business website	Single-domain or multi-domain	DV, or OV if identity matters	OV puts your company name in the certificate
WordPress on shared hosting	Single-domain	DV	Check whether your host already includes one
Online store	Single-domain or wildcard	OV or EV often preferred	Payment rules may apply
SaaS with customer subdomains	Wildcard	DV or OV	Custom domains need automation
Larger organization	Mix of types	OV / EV	Central management matters more than type

WordPress SSL certificate on shared hosting

Many shared hosts include a free certificate you switch on in the control panel. Buy your own when you want a paid DV or OV certificate, longer plan support or a specific brand, then upload it through cPanel. Our guide shows how to install an SSL certificate in cPanel and other panels. The trade-offs of host-included certificates are covered in free vs paid SSL certificates.

Online stores

A store needs HTTPS on every page, including cart, checkout and account pages. Payment-card rules, checkout coverage and validation choices for shops are covered in our guide to SSL for ecommerce stores.

Which SSL certificate is best for a SaaS app with customer subdomains?

Use a wildcard for *.app.com so every new customer subdomain is covered the moment you create it. Customer-owned custom domains (portal.customer.com) are different: you cannot put them on your wildcard, and listing them in a multi-domain certificate exposes your customer list and forces constant reissues.

For custom domains, issue one certificate per customer domain through automation, typically the ACME protocol (the standard API CAs use for automated issuance and renewal). With lifetimes shrinking, this is now a core part of SSL certificate management rather than an optional extra.

Enterprises

Larger organizations rarely need one type – they need many certificates, central visibility and consistent renewals. Volume accounts, approvals and policy controls are covered on our enterprise SSL page.

I run an agency with 30 client sites – one certificate or many?

Use one certificate per client (or per client project), not one shared certificate for all 30. A shared multi-domain certificate lists every client domain in plain view, ties all clients to one key and one renewal, and makes it messy to hand a site over when a client leaves.

Good fit for a shared multi-domain certificate	Pick per-client certificates if
Your agency’s own domains and staging hosts	Clients must not see each other’s names
Brands owned by the same company	Each client owns its domain and may switch agencies
A fixed set of names that rarely changes	Clients need OV with their own company name
One team controls all DNS and servers	Domain validation must go to each client’s own contacts

SSL certificates for web developers

Plan certificates as part of each project handover. Record who owns the account, which validation method you used, and where the private key lives. Keep staging on separate certificates or a dedicated wildcard, so a test environment never shares a key with production.

Public CAs do not issue certificates for internal names such as server.local or for reserved IP addresses (since 2015). For those, use a private CA instead – see self-signed vs CA-signed SSL.

Does the brand or certificate authority matter?

Less than coverage and validation. DigiCert and Sectigo (formerly Comodo CA), plus their brands GeoTrust, Thawte, RapidSSL and Comodo, all issue certificates trusted by every major browser. Differences show up in validation speed, support, management tools and price – our overview of the certificate authorities we sell compares them.