Trustico® CaaS OV + Wildcard + Multi Domain Information

Trustico® CaaS OV + Wildcard + Multi Domain is a multi-domain and wildcard SSL Certificate delivered through Trustico® Certificate as a Service (CaaS) that adds a verified organization identity through Organization Validation (OV). It secures a primary domain, additional names held as Subject Alternative Names (SANs), and wildcard names, all on one SSL Certificate.

The SSL Certificate is issued and reissued automatically through the Automatic Certificate Management Environment (ACME) protocol, the same as any other CaaS SSL Certificate, while your checked organization details are recorded across every secured name.

Coverage of named sites runs from a few names to hundreds, and a wildcard entry such as *.example.com secures unlimited subdomains beneath it. Learn About Multi Domain Coverage 🔗

Secures Multiple Domain Names 🔗	Secures Unlimited Subdomains 🔗
Verified Organization Validation (OV) 🔗	USD $1,000,000 Relying Party Warranty 🔗
Requires a Pre-Validation Reference 🔗	Automated Domain Control Validation (DCV) 🔗
Programmatic Management	Includes Hosted Issuance Tool 🔗
Includes Trustico® Site Seal 🔗	2048-bit Industry Standard SSL Certificate
Automated Installation	Unlimited Reissue Policy 🔗
99.9% Web Browser Ubiquity 🔗	Unlimited Server Licenses

The sections below explain what the SSL Certificate covers, how it is validated, and how the automation works.

Named Sites and Subdomains on One Automated SSL Certificate

This SSL Certificate combines two kinds of coverage. Separate names are held as Subject Alternative Names (SANs), which can be different domains such as example.com, example.net, and another-brand.com, along with individual subdomains, each carrying the same verified organization identity.

A wildcard entry such as *.example.com then secures every subdomain directly beneath that domain, including ones you create later, and the root domain is included. Coverage of named sites runs from a few names to hundreds. Explore Multi Domain Coverage 🔗

Each wildcard label position is covered by its own wildcard entry, so you can include a wildcard for more than one domain when your platform needs it. Understand Wildcard Coverage 🔗

Get Pre-Validated Before You Start

Before you order Trustico® CaaS OV + Wildcard + Multi Domain, you need a pre-validation reference, as the order cannot be submitted without one. The reference confirms that your organization has already been validated, so the organization checks are completed in advance rather than during each order. Learn About Getting Pre-Validated 🔗

A pre-validation reference stays valid for 398 days from activation and is reused across eligible orders in that time, which removes the repeated organization checks. A single reference covers all of our Certificate as a Service (CaaS) products that use Organization Validation (OV). Trustico® handles the pre-validation, and you enter the reference on the order form.

Verified Organization Identity

With Domain Validation (DV), an SSL Certificate confirms only control of the domain. Organization Validation (OV) records your checked company details inside the SSL Certificate, applied across every secured name and subdomain, where anyone can view them by inspecting it. It carries the most weight where sensitive data or payments are handled. Learn About Organization Validation (OV) 🔗

The Case for Certificate as a Service (CaaS) with Many Names

Managing an SSL Certificate that spans several domains and whole subdomain trees by hand grows awkward as the list changes. Each time it nears expiry, someone generates a Certificate Signing Request (CSR), completes validation for every name, downloads the files, and installs them on each server. Certificate as a Service (CaaS) automates all of that.

When you order Trustico® CaaS OV + Wildcard + Multi Domain, you are buying an SSL Certificate license for a set period. Throughout that period your ACME client reissues the SSL Certificate as it approaches expiry, so every name and subdomain stays protected for the term. Explore Certificate as a Service (CaaS) 🔗

When the license period nears its end, you can extend it without any reinstallation or reconfiguration across your servers. The extended validity is recognized automatically, with no need to generate new External Account Binding (EAB) credentials or change your automation. Learn About License Extensions 🔗

Validation with ACME

Trustico® CaaS OV + Wildcard + Multi Domain uses the Automatic Certificate Management Environment (ACME) protocol to run the SSL Certificate lifecycle. An ACME client on your server handles validation, issuance, installation, and reissue for every name, authenticating with the Certificate Authority (CA) using External Account Binding (EAB) credentials.

Pre-validation covers your organization, so there are no organization checks at order time. Control of each name is still confirmed on its own, on every order and on most reissues, through Domain Control Validation (DCV).

For a named site, the client answers a challenge by serving a token over HTTP or by publishing a Domain Name System (DNS) TXT record. A wildcard entry is always validated through Domain Name System (DNS), because the Certificate Authority (CA) must confirm control of the base domain rather than a single server. Explore ACME Protocol Details 🔗

Because a wildcard uses Domain Name System (DNS) validation, your ACME client needs to support a Domain Name System (DNS) challenge, which most complete through provider integrations such as Cloudflare, AWS Route 53, and DigitalOcean.

Supported ACME Clients

Any major Automatic Certificate Management Environment (ACME) client that supports Domain Name System (DNS) validation works with Trustico® CaaS OV + Wildcard + Multi Domain. Certbot covers wildcards through its Domain Name System (DNS) plugins, and acme.sh suits scripted, scheduled reissue with a wide range of provider integrations.

For Kubernetes, cert-manager issues and reissues the SSL Certificate as a native cluster resource. Windows environments are covered by win-acme and Certify The Web for Microsoft Internet Information Services (IIS), while lego, dehydrated, and Posh-ACME cover Go, shell, and PowerShell setups. Find Out More About Supported ACME Clients 🔗

These are not either-or choices. Your Certificate as a Service (CaaS) license allows unlimited SSL Certificate issuance for its domain names, and the same External Account Binding (EAB) credentials drive an ACME client, the cPanel Plugin, and the hosted issuance tool alike.

External Account Binding (EAB) Credentials

External Account Binding (EAB) links your ACME client to the Certificate Authority (CA). Trustico® creates a Key Identifier and an HMAC Key and sends them to you after purchase, and they are also available in your ordering account for a limited time. You provide them when you first set up the client.

The same External Account Binding (EAB) credentials can set up clients on different servers or environments, which helps where the same group of names is managed by more than one client across production, staging, and development. View Our External Account Binding (EAB) Credential Setup Guide 🔗

Encryption and Protocols

Trustico® CaaS OV + Wildcard + Multi Domain uses a 2048-bit RSA key with 256-bit symmetric encryption, applied consistently to every name and subdomain, over the Transport Layer Security (TLS) 1.2 and 1.3 protocols with SHA-256 hashing. Elliptic Curve Cryptography (ECC) keys are also supported for environments that benefit from smaller keys and faster handshakes. Compare Encryption Standards 🔗

Preparing for Shorter Validity Periods

Industry rules are reducing the maximum validity of an individual SSL Certificate in stages, to 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029. For an SSL Certificate covering many names and subdomains, replacing it that often by hand is impractical.

Certificate as a Service (CaaS) handles each reissue automatically, so the change in validity makes little difference to you. Your pre-validation reference keeps the organization stage ready, and the automation takes care of domain control and installation. Explore Traditional and CaaS Compared 🔗

USD $1,000,000 Warranty

Every Trustico® CaaS OV + Wildcard + Multi Domain SSL Certificate carries a USD $1,000,000 Relying Party Warranty covering the secured names and subdomains, which provides financial cover in the unlikely event that the Certificate Authority (CA) issues the SSL Certificate in error. Reissues are unlimited across the license through the automation. Review Warranty Details 🔗

Trustico® Site Seal

Your order includes a complimentary Trustico® site seal that you can display across your secured sites to reassure visitors. It works well on payment, sign-up, and contact pages. Explore the Trustico® Site Seal 🔗

Browser Compatibility

Each secured name and subdomain is trusted by around 99.9% of web browsers, including Chrome, Firefox, Safari, and Edge, and by mobile devices on iOS and Android without any additional configuration. Understand Browser Compatibility 🔗

Unlimited Server Licenses

You can install the SSL Certificate on as many servers as you need at no extra cost. This matters when your names and subdomains run on separate infrastructure, across web servers, application servers, load balancers, and container nodes. The same SSL Certificate and key are deployed to each server that serves a secured name.

Your SSL Certificate License

Your purchase is an SSL Certificate license for the term you choose, and a multiple year license fixes the current pricing for the whole term. Because an individual SSL Certificate has a maximum validity set by industry rules, the license is kept current by reissuing the SSL Certificate during the term.

Reissues are free and unlimited across the license, and the automation handles them for you. The secured names, wildcard coverage, and verified organization identity carry across each reissue, and while your pre-validation reference is valid the organization stage is reused. Manage your license in the Trustico® Tracking System 🔗

Who Should Use Trustico® CaaS OV + Wildcard + Multi Domain

It fits a business that runs several websites alongside subdomain-heavy platforms, provisioned through infrastructure as code with tools such as Terraform, Ansible, and CloudFormation, with a verified identity behind each name.

It also suits agencies and hosting providers securing many client domains and their subdomains under one automated SSL Certificate, and software-as-a-service platforms that assign customer subdomains such as client.yourdomain.com. Learn About the Partner Service 🔗

Other Options

If you do not need a verified organization identity, the Domain Validation (DV) version of this product secures the same names and subdomains through the same automation, with domain checks only. Compare Trustico® CaaS DV + Wildcard + Multi Domain 🔗