AFAIK, all major browsers follow RFC 6125 which says that only single-level wildcards are supported. https://tools.ietf.org/html/rfc6125#section-6.4.3 https://

AFAIK, all major browsers follow RFC 6125 which says that only single-level wildcards are supported. https://tools.ietf.org/html/rfc6125#section-6.4.3 https://tools.ietf.org/html/rfc6125#section-6.4.3 https://bugzilla.mozilla.org/show_bug.cgi?id=646613 https://bugzilla.mozilla.org/show_bug.cgi?id=646613 https://code.google.com/p/chromium/issues/detail?id=70517 https://code.google.com/p/chromium/issues/detail?id=70517 Your best bet is probably to wait for Let's Encrypt to be generally available, so that you can automatically generate a separate certificate for every hostname.