Sectigo® CaaS OV + Wildcard Information

Sectigo® CaaS OV + Wildcard is a Wildcard SSL Certificate delivered through Trustico® Certificate as a Service (CaaS) that adds a verified organization identity through Organization Validation (OV). It secures every subdomain directly under your domain, at *.yourdomain.com, along with the root domain yourdomain.com.

The SSL Certificate is issued and reissued automatically through the Automatic Certificate Management Environment (ACME) protocol, the same as any other CaaS SSL Certificate, while your checked organization details are recorded inside it. One order covers unlimited subdomains at that level, including ones you add later.

It suits teams that manage subdomains programmatically and also want a checked business identity across every covered name. Because it is delivered through Certificate as a Service (CaaS), the whole lifecycle runs without manual steps, across every server that serves your subdomains. Learn About Domain Names Secured Free 🔗

Verified Organization Validation (OV) 🔗	Secures Domain and Unlimited Subdomains 🔗
USD $1,000,000 Relying Party Warranty 🔗	2048-bit Industry Standard SSL Certificate
Requires a Pre-Validation Reference 🔗	Automated Domain Control Validation (DCV) 🔗
Programmatic Management	Includes Hosted Issuance Tool 🔗
Includes Sectigo® Site Seal 🔗	Unlimited Server Licenses
Automated Installation	Unlimited Reissue Policy 🔗
99.9% Web Browser Ubiquity 🔗	Extend the License Without Reinstallation

The sections below explain what the SSL Certificate covers, how it is validated, and how the automation works.

Sectigo® as a Trusted Certificate Authority (CA)

Sectigo® is a long-established, widely trusted commercial Certificate Authority (CA), with root Certificates present in virtually every browser, operating system, and device. An SSL Certificate issued under the Sectigo® roots is recognized straight away, with no extra configuration or trust store updates.

Choosing Sectigo® CaaS OV + Wildcard gives you that established trust together with a verified organization identity and automated delivery through the Trustico® platform. Learn About the Sectigo® Certificate Authority (CA) 🔗

Full Wildcard Subdomain Coverage

A single *.yourdomain.com entry secures every subdomain directly beneath yourdomain.com, such as app.yourdomain.com, staging.yourdomain.com, and api.yourdomain.com, and the root domain yourdomain.com is included as well. There is no need to hold a separate SSL Certificate for each subdomain.

Coverage applies to the single level where the asterisk sits, so a deeper name such as api.eu.yourdomain.com falls outside *.yourdomain.com and needs its own wildcard. New subdomains at the covered level are protected the moment they are created. Understand Wildcard Coverage 🔗

Get Pre-Validated Before You Start

Before you order Sectigo® CaaS OV + Wildcard, you need a pre-validation reference, as the order cannot be submitted without one. The reference confirms that your organization has already been validated, so the organization checks are completed in advance rather than during each order. Learn About Getting Pre-Validated 🔗

A pre-validation reference stays valid for 398 days from activation and is reused across eligible orders in that time, which removes the repeated organization checks. A single reference covers all of our Certificate as a Service (CaaS) products that use Organization Validation (OV). Trustico® handles the pre-validation, and you enter the reference on the order form.

Verified Organization Identity

With Domain Validation (DV), an SSL Certificate confirms only control of the domain. Organization Validation (OV) records your checked company details inside the SSL Certificate, applied across every covered name, where anyone can view them by inspecting it. It carries the most weight where sensitive data or payments are handled. Learn About Organization Validation (OV) 🔗

The Case for Certificate as a Service (CaaS)

Managing a Wildcard SSL Certificate by hand gets harder as your subdomains grow. Each time it nears expiry, someone must generate a Certificate Signing Request (CSR), complete validation, download the files, and install them on every server that serves your subdomains. Certificate as a Service (CaaS) automates all of that.

When you order Sectigo® CaaS OV + Wildcard, you are buying an SSL Certificate license for a set period. Throughout that period your ACME client reissues the Wildcard SSL Certificate as it approaches expiry, so every subdomain stays protected for the term with no manual work. Explore Certificate as a Service (CaaS) 🔗

When the license period nears its end, you can extend it without any reinstallation or reconfiguration across your servers. The extended validity is recognized automatically, with no need to generate new External Account Binding (EAB) credentials or change your automation. Learn About License Extensions 🔗

Wildcard Automation with ACME

Sectigo® CaaS OV + Wildcard uses the Automatic Certificate Management Environment (ACME) protocol to run the SSL Certificate lifecycle. An ACME client on your server handles validation, issuance, installation, and reissue, authenticating with the Certificate Authority (CA) using External Account Binding (EAB) credentials from your Trustico® account.

A Wildcard SSL Certificate is validated through Domain Name System (DNS) validation, because the Certificate Authority (CA) must confirm control of the base domain rather than a single server.

The client creates a temporary Domain Name System (DNS) TXT record, and many clients automate this through integrations with providers such as Cloudflare, AWS Route 53, and DigitalOcean. Because this method does not need your web server to be publicly reachable, it also works for subdomains behind a firewall.

The ACME client does not even need to run on the servers that use the Wildcard SSL Certificate. A single client on a separate machine can validate, receive the SSL Certificate, and hand it to each server that needs it. Explore ACME Protocol Details 🔗

Domain Control Validation (DCV)

Pre-validation covers your organization, not your domain. Domain Control Validation (DCV) is a separate step that proves you control the domain, and it is completed automatically on each order and on most reissues, even where a pre-validation reference is in place.

For a wildcard, control is proven through Domain Name System (DNS) validation. The file-based method used for single names cannot be used for a wildcard, since a wildcard is not tied to one web address where a file could be found. Read about Wildcard Validation 🔗

Supported ACME Clients for Wildcard Deployment

Any major ACME client that supports Domain Name System (DNS) validation works with Sectigo® CaaS OV + Wildcard. Certbot supports wildcards through its Domain Name System (DNS) plugins, and acme.sh offers a wide range of provider integrations that suit scripted, scheduled reissue.

For Kubernetes, cert-manager issues and reissues wildcards as a native cluster resource. Windows environments are covered by win-acme and Certify The Web for Microsoft Internet Information Services (IIS), while lego, dehydrated, and Posh-ACME cover Go, shell, and PowerShell setups. Find Out More About Supported ACME Clients 🔗

These are not either-or choices. Your Certificate as a Service (CaaS) license allows unlimited SSL Certificate issuance for its domain names, and the same External Account Binding (EAB) credentials drive an ACME client, the cPanel Plugin, and the hosted issuance tool alike.

External Account Binding (EAB) Credentials

External Account Binding (EAB) links your ACME client to the Certificate Authority (CA). Trustico® creates a Key Identifier and an HMAC Key and sends them to you after purchase, and they are also available in your ordering account for a limited time. You provide them when you first set up the client.

The same External Account Binding (EAB) credentials can set up clients on different servers or environments, which helps where one *.yourdomain.com SSL Certificate is managed by more than one client across production, staging, and development. View Our External Account Binding (EAB) Credential Setup Guide 🔗

Encryption and Protocols

Sectigo® CaaS OV + Wildcard uses a 2048-bit RSA key with 256-bit symmetric encryption applied consistently to every subdomain, over the Transport Layer Security (TLS) 1.2 and 1.3 protocols with SHA-256 hashing. Elliptic Curve Cryptography (ECC) keys are also supported for environments that benefit from smaller keys and faster handshakes. Compare Encryption Standards 🔗

Preparing for Shorter Validity Periods

Industry rules are reducing the maximum validity of an individual SSL Certificate in stages, to 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029. For a wildcard that protects many subdomains across several servers, replacing it that often by hand is impractical.

Certificate as a Service (CaaS) handles each reissue automatically, so the change in validity makes little difference to you. Your pre-validation reference keeps the organization stage ready, and the automation takes care of domain control and installation. Explore Traditional and CaaS Compared 🔗

USD $1,000,000 Warranty

Every Sectigo® CaaS OV + Wildcard SSL Certificate carries a USD $1,000,000 Relying Party Warranty covering the secured names, which provides financial cover in the unlikely event that the Certificate Authority (CA) issues the SSL Certificate in error. Reissues are unlimited across the license through the automation. Review Warranty Details 🔗

Sectigo® Site Seal

Your order includes a Sectigo® site seal that you can display across your subdomains to reassure visitors. It works well on payment, sign-up, and contact pages. Explore Trust Seals 🔗

Browser Compatibility

Every secured subdomain is trusted by around 99.9% of web browsers, including Chrome, Firefox, Safari, and Edge, and by mobile devices on iOS and Android without any additional configuration. Understand Browser Compatibility 🔗

Unlimited Server Licenses

You can install the Wildcard SSL Certificate on as many servers as you need at no extra cost. This matters for cloud-native setups where the same *.yourdomain.com SSL Certificate must be present on every node that serves your subdomains, across web servers, application servers, load balancers, and containers.

Your SSL Certificate License

Your purchase is an SSL Certificate license for the term you choose, and a multiple year license fixes the current pricing for the whole term. Because an individual SSL Certificate has a maximum validity set by industry rules, the license is kept current by reissuing the SSL Certificate during the term.

Reissues are free and unlimited across the license, and the automation handles them for you. While your pre-validation reference is valid, the organization stage is reused, and domain control is confirmed on each reissue as normal. Manage your license in the Trustico® Tracking System 🔗

Who Should Use Sectigo® CaaS OV + Wildcard

It fits teams using infrastructure as code to provision wildcards through tools such as Terraform, Ansible, and CloudFormation, and organizations running containerized applications across Kubernetes clusters that create subdomains dynamically, where a verified identity should travel with every covered name.

It also suits continuous integration pipelines that spin up feature-branch environments, and software-as-a-service platforms that assign customer subdomains such as client.yourdomain.com, where each new subdomain needs securing the moment it is created.

Other Options

If you do not need a verified organization identity, the Domain Validation (DV) version of this product secures the same subdomains through the same automation, with domain checks only. Compare Sectigo® CaaS DV + Wildcard 🔗