# \[Help\] About SSL for a domain mapping with wildcard domain **URL:** \ **Category:** Help\ **Created:** [July 11, 2017, 4:09pm UTC](https://community.letsencrypt.org/t/help-about-ssl-for-a-domain-mapping-with-wildcard-domain/37917 "2017-07-11T16:09:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![vnatuan1989](https://avatars.discourse-cdn.com/v4/letter/v/c77e96/32.png) [@vnatuan1989](https://community.letsencrypt.org/u/vnatuan1989)\ **Post date:** [July 11, 2017, 4:09pm UTC](https://community.letsencrypt.org/t/help-about-ssl-for-a-domain-mapping-with-wildcard-domain/37917/1 "2017-07-11T16:09:08Z")
Hello all , I had a domain which I mapping with wildcard domain. Example : I had [example.com](http://example.com) mapping with [example.company.com.au](http://example.company.com.au) . Now I set SSL for [example.company.com.au](http://example.company.com.au) with SSL key from Letsencrypt in conf file. Question : 1. Do I have SSL for [example.com](http://example.com) if I set SSL for [example.company.com.au](http://example.company.com.au) ? 2. I have over 100 domains and I mapping with over 100 wildcard domain in a conf file , I buy a wildcard certificate key from third company which I can use for over 100 domains . I set this key in conf file , Do I have SSL for 100 domains when I use URL : [example.com](http://example.com) … Thank you . ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [July 11, 2017, 4:19pm UTC](https://community.letsencrypt.org/t/help-about-ssl-for-a-domain-mapping-with-wildcard-domain/37917/2 "2017-07-11T16:19:23Z")
> [@vnatuan1989](#): > > 1. Do I have SSL for [example.com](http://example.com) if I set SSL for example.company.com.au ? > 2. I have over 100 domains and I mapping with over 100 wildcard domain in a conf file , I buy a wildcard certificate key from third company which I can use for over 100 domains . I set this key in conf file , Do I have SSL for 100 domains when I use URL : [example.com](http://example.com) ... If I understand your question correctly, the answer to both questions is no. Wildcards don't cover the base domain, only subdomains; certificates for the base domain don't cover subdomains. For example, a certificate for \*.example.com does not cover [example.com](http://example.com), while a certificate for [example.com](http://example.com) does not cover [foo.example.com](http://foo.example.com). As you probably know, Let's Encrypt doesn't issue wildcard certificates yet, but will start in January. If you need wildcard certificates before then, you should probably get them from a different CA. With Let's Encrypt's current service, you must explicitly list all of the names that you want to be covered by your certificate. You can have 100 names per certificate, but if you need to cover more names than that, you can get more than one certificate (up to 20 new ones per week). When most clients connect, they send the SNI extension to indicate what server name they expect, and most web server applications can choose the correct certificate based on that information. ---
**Author:** ![vnatuan1989](https://avatars.discourse-cdn.com/v4/letter/v/c77e96/32.png) [@vnatuan1989](https://community.letsencrypt.org/u/vnatuan1989)\ **Post date:** [July 11, 2017, 4:25pm UTC](https://community.letsencrypt.org/t/help-about-ssl-for-a-domain-mapping-with-wildcard-domain/37917/3 "2017-07-11T16:25:24Z")
> [@schoen](#): > > If I understand your question correctly, the answer to both questions is no. Wildcards don't cover the base domain, only subdomains; certificates for the base domain don't cover subdomains. > > For example, a certificate for \*.example.com does not cover [example.com](http://example.com), while a certificate for [example.com](http://example.com) does not cover [foo.example.com](http://foo.example.com). > > As you probably know, Let's Encrypt doesn't issue wildcard certificates yet, but will start in January. If you need wildcard certificates before then, you should probably get them from a different CA. > > With Let's Encrypt's current service, you must explicitly list all of the names that you want to be covered by your certificate. You can have 100 names per certificate, but if you need to cover more names than that, you can get more than one certificate (up to 20 new ones per week). When most clients connect, they send the SNI extension to indicate what server name they expect, and most web server applications can choose the correct certificate based on that information. Now , I have [example.com](http://example.com) mapping with example.company.com.au . Where I put SSL key for [example.com](http://example.com) ? If I put it in conf file of example.company.com.au , Do [example.com](http://example.com) have it ? thank Schoen . ---
**Author:** ![vnatuan1989](https://avatars.discourse-cdn.com/v4/letter/v/c77e96/32.png) [@vnatuan1989](https://community.letsencrypt.org/u/vnatuan1989)\ **Post date:** [July 11, 2017, 4:45pm UTC](https://community.letsencrypt.org/t/help-about-ssl-for-a-domain-mapping-with-wildcard-domain/37917/4 "2017-07-11T16:45:38Z")
hi Schoen , Sorry about my stupid question , I don’t have good knowledge in SSL . I still have issue with domain and wildcard domain when I mapping it. I know when I set SSL for wildcard domain : [example.company.com.au](http://example.company.com.au) , the domain :example.com is not effect , We must setup SSL for [example.com](http://example.com) too , but I have over 100 domain , it will increase in future . I can not buy CA and setup for each domain , because that I want ask a question : Do I have solution for it ? I can buy a CA key and I setup it on server , it will CA for all domain (from Letsencrypt or any company) Thank you , Schoen . ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [July 11, 2017, 6:14pm UTC](https://community.letsencrypt.org/t/help-about-ssl-for-a-domain-mapping-with-wildcard-domain/37917/5 "2017-07-11T18:14:21Z")
> [@vnatuan1989](#): > > I know when I set SSL for wildcard domain : example.company.com.au , the domain :example.com is not effect , > We must setup SSL for [example.com](http://example.com) too , but I have over 100 domain , it will increase in future . > I can not buy CA and setup for each domain , because that I want ask a question : > > Do I have solution for it ? I can buy a CA key and I setup it on server , it will CA for all domain (from Letsencrypt or any company) If you were doing this for internal, private use (only within your organization), you can simply create your own internal CA and then make all of the machines inside your organization trust that CA. However, that solution isn't applicable if you're doing public web hosting which is meant to be used by people outside of your organization. Certificate authorities are mostly not allowed to delegate the power to you to make arbitrary certificates. There is a special case if the certificates that you need are all subdomains of one single domain, like at a university; then you can sign a contract with certain CAs that designates you as a registration authority (RA) for that domain and then they will believe your requests about whatever certificates you want to issue for those subdomains. There are apparently ways for ISPs and CDNs to get a broader version of this power but I don't know how that works bureaucratically or administratively. Much of the point of Let's Encrypt is that it's supposed to be _automated_, whenever possible. For example, there are some organizations that literally have hundreds of thousands of certificates from Let's Encrypt. They are using databases and scripts to manage all of the issuance, configuration, and renewal. So for example, I believe they have database records tracking all of the domain names that they need certificates for, and the status of each certificate. When a new certificate is needed, a software application requests it automatically without any human intervention. This is a fully supported use case. The key idea is that computer software should do the work, rather than a human being doing it. In that case, hundreds of domains may not be a problem because that is a small number to a computer, even if it is a big number to a human. ---
**Author:** ![ahaw021](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ahaw021/32/14882_2.png) [@ahaw021](https://community.letsencrypt.org/u/ahaw021)\ **Post date:** [July 13, 2017, 11:28am UTC](https://community.letsencrypt.org/t/help-about-ssl-for-a-domain-mapping-with-wildcard-domain/37917/6 "2017-07-13T11:28:32Z")
> [@vnatuan1989](#): > > I had a domain which I mapping with wildcard domain. Explain that in a different way please Assume you have the following domains [example.com](http://example.com) > **[Something Else Strategies](https://somethingelse.com)** [completelydifferent.com](http://completelydifferent.com) and under these you have the following subdomains [mail.example.com](http://mail.example.com) [www.example.com](http://www.example.com) [vpn.example.com](http://vpn.example.com) > **[Something Else Strategies](https://somethingelse.com/)** [mail.somethingelse.com](http://mail.somethingelse.com) [vpn.somethingelse.com](http://vpn.somethingelse.com) [www.completelydifferent.com](http://www.completelydifferent.com) > I have over 100 domains and I mapping with over 100 wildcard domain in a conf file Once again this doesn't really make sense why are you mapping and what do you mean by mapping. Try to avoid using words like wildcard unless you are sure of their use as they mean a very specific thing in SSL Andrei ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [August 12, 2017, 11:28am UTC](https://community.letsencrypt.org/t/help-about-ssl-for-a-domain-mapping-with-wildcard-domain/37917/7 "2017-08-12T11:28:50Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.