SSL证书二级标签带*的SAN配置可行性及增配相关问题咨询

Let's break down each of your questions clearly, rooted in the CA/B Forum Baseline Requirements—the mandatory rules every public certificate authority (CA) must follow:

1. Can a SAN entry in a single SSL certificate include a wildcard in a secondary label? #

Nope. The rules strictly limit wildcards to the leftmost label of a domain entry. That means *.mydomain.com is valid, but something like label.*.mydomain.com is not. Wildcards are designed to match exactly one full domain label (e.g., shop in shop.mydomain.com), not partial labels or labels placed in the middle of the domain string.

2. Can I buy a single certificate for mydomain.com that supports *.mydomain.com plus SAN records for label1.*.mydomain.com and label2.*.mydomain.com? #

Short answer: No, but let's clarify why and what you can do instead:

• First, label1.*.mydomain.com and label2.*.mydomain.com are invalid entries per CA/B rules—no public CA will issue a certificate containing these.
• Second, *.mydomain.com only covers direct subdomains of mydomain.com (like blog.mydomain.com or checkout.mydomain.com). It does not cover deeper subdomains such as label1.blog.mydomain.com.
• If your goal is to cover all subdomains under label1.mydomain.com, you’d need a valid wildcard entry like *.label1.mydomain.com added to the SAN. You can absolutely include this alongside mydomain.com and *.mydomain.com in a single certificate, as long as your CA allows multiple SAN entries (most do).

3. How much does it cost to add a SAN record like label3.*.mydomain.com? #

Since label3.*.mydomain.com is an invalid entry, you can’t add it to any public SSL certificate. If you adjust this to a valid wildcard entry like *.label3.mydomain.com, the cost depends on a few factors:

• Certificate type: DV (Domain Validated) certificates are cheapest—many providers include 5-10 free SAN entries, with extra entries costing $5-$20 each. OV (Organization Validated) or EV (Extended Validation) certificates are pricier, with extra SAN entries ranging from $20-$100+.
• CA provider: Pricing varies widely—for example, Let's Encrypt offers free DV certificates with unlimited SAN entries, while paid CAs have tiered pricing structures.

4. How long does it take to add such a SAN record? #

Again, label3.*.mydomain.com isn’t allowed, so let’s focus on valid entries like *.label3.mydomain.com:

• DV certificates: If adding to an existing DV cert, verification is usually fast—anywhere from a few minutes to a couple of hours, since it only requires proving control over the domain.
• OV/EV certificates: These require verifying your organization’s legal identity, so adding a SAN entry can take 1-5 business days, similar to the initial certificate issuance timeline.
• Some CAs offer streamlined "SAN update" processes, but the timeline still depends on the validation type.

内容的提问来源于stack exchange，提问作者greggyNapalm