Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a wildcard certificate?
Short answer
A wildcard certificate is a certificate that carries a name in the form *.example.com in its SAN list and covers all the subdomains of a domain at a single level: www.example.com and api.example.com are in scope; example.com itself and two-level names such as a.b.example.com are out of scope. In TR7, a wildcard certificate is added to the SSL/TLS Certificates screen like other certificates and is selected in the Certificate field of the vService; when it is obtained automatically with ACME, it can be obtained only with Challenge Type = DNS-01.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Certificates & PKI → SSL/TLS Certificates → Add → ACME.SH | Challenge Type = DNS-01, DNS Provider | Obtaining the wildcard certificate with ACME; if a name that starts with *. is entered while HTTP-01 is selected, the form gives the Wildcard domains require the DNS-01 challenge error |
| SSL/TLS Certificates → Add → Manual or PFX | Certificate content or PFX file | Uploading a wildcard certificate obtained from another CA |
| SSL/TLS Certificates → CSR (External CA) | Subject Alternative Names | Writing the *.example.com name into the CSR and having it signed by an external CA |
| HTTP vService and L7 TCP vService | Certificate | Presenting the wildcard certificate; if a certificate whose name matches exactly is also selected, that certificate is presented first |
Common Misconceptions
- "
*.example.comalso covers the main domain." It does not; forexample.com, the name is added to the SAN list separately. - "A wildcard also covers two-level subdomains."
*stands in for only the single leftmost label;a.b.example.comis out of scope (RFC 9525). - "A wildcard certificate can also be obtained with HTTP-01 in ACME." ACME accepts only DNS-01 validation for wildcard names; in TR7, an ACME DNS Providers profile is required for DNS-01 (What is the difference between HTTP-01 and DNS-01 in ACME; why is DNS-01 required for wildcards?).
How it is done in the documentation
