You run a Kenyan business with a main site at yourbusiness.co.ke, a blog at blog.yourbusiness.co.ke, and a customer portal at portal.yourbusiness.co.ke. 

Your main site has a shiny padlock, but the blog and portal do not. 

Now you are wondering if you need to buy and install three separate SSL certificates to get everything secured.

The short answer is no, you almost never need a separate certificate for every subdomain. 

A single, well-chosen certificate can usually cover your whole domain and every subdomain that sits underneath it. 

The part that trips people up is picking the right type of certificate for how their subdomains are actually structured, and that is exactly what this guide walks through.

What Actually Counts as a Subdomain

Before comparing certificate types, it helps to know what you are securing.

A subdomain is any address that sits in front of your main domain, separated by a dot.

 If your domain is yourbusiness.co.ke, then blog.yourbusiness.co.ke and shop.yourbusiness.co.ke are both first-level subdomains.

Go one level deeper, such as staging.blog.yourbusiness.co.ke, and you now have a second-level subdomain. 

This distinction matters a lot for certificate selection, because not every certificate type reaches that deep.

Kenyan businesses run into this constantly without realizing it.

A SACCO might have a main site, a member portal at portal.sacco.co.ke, and a loan calculator at loans.sacco.co.ke.

A university might run admissions.university.ac.ke and elearning.university.ac.ke alongside the main domain. 

Each of these is a first-level subdomain, and each one needs its own valid HTTPS connection, separate from whatever certificate secures the main site.

Your Three Real Options

Once you move past single-domain certificates, which only ever cover one exact address, you have three practical ways to secure multiple subdomains at once.

Wildcard SSL Certificates

A wildcard certificate secures your main domain plus an unlimited number of first-level subdomains, all under one certificate written as .yourbusiness.co.ke. 

That single certificate would automatically cover blog.yourbusiness.co.ke, shop.yourbusiness.co.ke, mail.yourbusiness.co.ke, and any new first-level subdomain you add later, with no extra purchase needed.

This is the option most small and medium Kenyan businesses reach for, because it is the cheapest way to stop worrying about subdomains one at a time. 

The catch is right there in the name. A wildcard only reaches one level deep. 

The certificate .yourbusiness.co.ke will not secure staging.blog.yourbusiness.co.ke, since that address sits two levels below the root domain.

Pricing for a wildcard certificate typically runs higher than a basic single-domain certificate, but well below buying several standard certificates separately. 

For most businesses managing three to ten subdomains, a wildcard pays for itself the first time a new subdomain gets added without needing a fresh certificate purchase.

Multi-Domain (SAN) Certificates

A Subject Alternative Name certificate, usually just called a multi-domain or SAN certificate, works differently. 

Instead of a wildcard pattern, you list out every specific domain and subdomain you want covered, by name, when you order the certificate.

This suits a business running several unrelated domains rather than one domain with many subdomains. 

If you own yourbusiness.co.ke and a second brand at anotherbrand.co.ke, a SAN certificate can secure both, along with a handful of named subdomains on each, all under one certificate.

The tradeoff is flexibility. 

Add a new subdomain later that was not listed on the original order, and it will not be secured until you request a reissue to add it.

Multi-Domain Wildcard Certificates

This is the option built for businesses with real complexity. 

It combines both approaches, letting you list several separate root domains as SANs while also applying a wildcard pattern to each one.

For a Kenyan company running yourbusiness.co.ke and yourbusiness.com side by side, each with its own set of blog, shop, and portal subdomains. 

A multi-domain wildcard certificate covers the lot without demanding a fresh certificate for every new subdomain added under either domain.

The One Limitation Almost Everyone Misses

Every wildcard certificate, whether standalone or bundled into a multi-domain wildcard, only ever reaches one level of subdomain below the point where the asterisk sits. 

This single detail causes more confusion than anything else in SSL shopping, so it is worth slowing down on.

Take the certificate .yourbusiness.co.ke as an example. It will secure:

• shop.yourbusiness.co.ke

• blog.yourbusiness.co.ke

• portal.yourbusiness.co.ke

It will not secure:

• staging.shop.yourbusiness.co.ke

• dev.blog.yourbusiness.co.ke

• api.portal.yourbusiness.co.ke

Certificate authorities will not issue a certificate written as yourbusiness.co.ke.

The wildcard pattern only ever collapses one dot, by design, because validating ownership across an unlimited chain of subdomains would be nearly impossible to verify safely.

If your business genuinely runs second-level subdomains like staging environments under each product line, you have two workable paths. 

• You can issue a separate wildcard for each subdomain branch, such as: .shop.yourbusiness.co.ke alongside .yourbusiness.co.ke

• You can move to a multi-domain wildcard certificate and list each branch as its own SAN with its own wildcard applied.

How to Choose Between Them

Match the certificate to how your subdomains are actually structured rather than to how many you happen to have today.

Choose a wildcard certificate if:

You run one primary domain with a handful of first-level subdomains, such as blog, shop, mail, or portal, and you expect to add more subdomains under that same domain over time without wanting to touch your SSL setup again.

Choose a multi-domain (SAN) certificate if:

You manage a small, fixed number of separate domains or specifically named subdomains, and you are comfortable requesting a reissue on the rare occasion you add a new one.

Choose a multi-domain wildcard certificate if:

You run multiple domains, each with its own growing set of subdomains, and you want the flexibility of both approaches without juggling several separate certificates across your business.

What This Looks Like in Practice

A small online shop running shop.yourbusiness.co.ke and blog.yourbusiness.co.ke alongside the main site needs nothing more than a single wildcard certificate. 

That covers everything, current and future, at that one level.

A SACCO or school running a member portal, a payments subdomain, and a separate results checking site, each on a distinct domain name, is better served by a multi-domain certificate that lists each one by name.

A growing company running two country domains, each with its own staging, shop, and blog subdomains, is the case where a multi-domain wildcard genuinely earns its higher price tag. 

Trying to force that setup onto a single basic wildcard would leave the deeper staging subdomains completely unsecured, no matter how the main domain looks.

How to Check What Your Current Certificate Actually Covers

Before buying anything new, it is worth confirming exactly what your existing certificate secures, since many site owners assume broader coverage than they actually have.

• Visit each subdomain in your browser and click the padlock icon next to the address bar.

• Select the option to view certificate details, then look for the field labeled Common Name or Subject Alternative Names.

• Compare that list against every subdomain your business actually uses, including ones added recently that nobody remembered to check.

• If a subdomain is missing from that list entirely, it is not covered, even if the main domain shows a valid padlock.

Running this check across your full list of subdomains takes a few minutes and often reveals a forgotten staging site or an old subdomain still sitting on HTTP.

It is worth repeating this check after any hosting migration, too.

Moving a subdomain to new infrastructure sometimes leaves the old certificate behind, or points the subdomain at a server where the certificate was never installed in the first place.

What Happens If You Choose the Wrong Certificate Type

Getting this wrong is rarely a security disaster, but it usually turns into a repeated cost. 

Business owners who install a plain single-domain certificate on their main site, then add a blog and a shop subdomain later, often discover the hard way that neither new subdomain is covered.

The fix at that point means buying a wildcard or SAN certificate anyway, reinstalling it everywhere the old certificate lived, and updating DNS or load balancer settings a second time. 

That is twice the setup work for the price of one certificate done right from the start. The same applies in reverse.

 A business that buys an expensive multi-domain wildcard certificate to cover three subdomains under one single domain is paying for flexibility it does not need. 

A standard wildcard would have done the same job for less.

Getting the Right Certificate Installed the First Time

Picking between a wildcard, a SAN certificate, and a multi-domain wildcard is a decision worth getting right from the start. 

Since switching certificate types later means reissuing and reinstalling across every subdomain involved.

Truehost offers wildcard SSL certificates in Kenya from KSh 1,000 a year, along with multi-domain and multi-domain wildcard options for businesses running more than one root domain. 

Every certificate includes free installation support, if your subdomains sit on our hosting or elsewhere. 

So you are not left guessing which server needs the files or how the private key gets applied across multiple subdomains.

If you are not sure which structure fits your setup, our team can review your subdomain list and recommend the right certificate before you buy anything.

Common Questions From Site Owners Setting This Up

Business owners asking about subdomain SSL almost always land on a handful of the same practical concerns.

1. Does the free certificate that comes with my hosting cover subdomains too?

It depends entirely on what your host actually issued. Many free certificates, including those from Let’s Encrypt, cover only the single domain and subdomain named at setup unless you specifically request a wildcard version, which not every free issuance process supports automatically.

2. If I install a wildcard certificate, do I still need to do anything for each subdomain?

Yes. The certificate itself covers the domain names, but each subdomain still needs the certificate properly installed and pointed at the correct hosting location or load balancer, especially if your subdomains run on different servers.

3. Will a wildcard certificate work if my subdomains are hosted with different providers?

Yes, as long as you can install the same certificate and its private key on each server involved. This is common for businesses that host their main site with one provider and a separate app or portal subdomain elsewhere.

4. Does adding a wildcard certificate cost much more than a standard one?

It costs more than a single-domain certificate, but usually far less than buying individual certificates for every subdomain separately, especially once you have three or more subdomains to cover.

5. Can I upgrade from a standard certificate to a wildcard later without starting over?

Yes. You can purchase a wildcard certificate at any point and install it in place of the old one. Your existing subdomains need the new certificate applied, which most hosting control panels handle in a few clicks.

6. Does a wildcard certificate protect against every type of attack on my subdomains?

No. A wildcard certificate encrypts the connection between your visitors and each subdomain and confirms the domain’s identity, but it does not replace other security measures, such as strong admin passwords, regular software updates, or a firewall on subdomains that handle logins or payments.

The Bottom Line

You do not need a separate SSL certificate for every subdomain, and in almost every case, you should actively avoid that approach. 

• A wildcard certificate handles one primary domain and its first-level subdomains for a single, predictable price. 

• A multi-domain certificate handles a fixed list of separate domains and subdomains. 

• A multi-domain wildcard combines both when your business runs multiple domains with their own growing subdomain trees.

Look at how your subdomains are actually structured, remember that wildcards only reach one level deep, and the right certificate choice becomes obvious well before you get anywhere near checkout.