Cheap wildcard SSL cert? The free wildcard included with Bridge CDN

9 min readUpdated Oct 2026

If you came here pricing a cheap wildcard SSL cert, there is none to buy on Bridge CDN: the certificate for your domain and the wildcard *.example.com are included with the account, issued and renewed by Bridge SSL, the certificate layer of Bridge CDN. It is the wildcard half of a certificate you never have to renew. Two conditions come with it: the site is served through Bridge CDN, and the domain's DNS is on Bridge DNS. Without Bridge DNS, hostnames on Bridge CDN still get an ordinary certificate for their specific names; only the wildcard is unavailable.

Price: included with a Bridge CDN account: nothing per certificate, nothing per wildcard, nothing per renewal
Covers: the domain and *.example.com, domain-validated; one wildcard per domain
Requires: the site served through Bridge CDN; for the wildcard, also the domain's DNS on Bridge DNS
Proof of control: ACME DNS-01 (RFC 8555 §8.4) [2], with the record placed and removed by the platform
Matching: one label in place of the asterisk (RFC 9525 §6.3) [4]
Renewal: ahead of expiry, by the layer that serves the site, written down per hostname

What "free" means for this wildcard

Free here means included with the Bridge CDN account, not handed to anyone without one. Bridge SSL is not sold on its own, so there is no separate SSL plan and no extra line for wildcards. The account you already have pays for both the certificate and the wildcard.

That also makes it a different thing from a cheap wildcard SSL certificate bought from a reseller. There is no certificate file to take to another server: nothing is installed, the platform holds the key, and the certificate works only for hostnames Bridge CDN serves. At commercial authorities a wildcard is a second, separately priced certificate. Here the domain and *.example.com are issued as one certificate, with both names listed in its subjectAltName.

What comes with a Bridge CDN account
What comes with the account	On Bridge CDN
Domain-validated certificate for the domain	included
Wildcard `*.example.com`	included
Renewals	included
Installation and configuration	nothing to do
DNS-01 record at each issue and renewal	placed and removed by the platform
Record of every issue and renewal	written per hostname

Current terms and plans for the account itself live on the Bridge CDN site, where signup does.

Why the wildcard needs Bridge DNS

The free wildcard on Bridge CDN is issued only when the domain's DNS is on Bridge DNS. The reason is the validation method, not a pricing rule.

A public authority may validate a wildcard only by a method the CA/Browser Forum Baseline Requirements mark for wildcards. Their table of methods (version 2.3.1, §3.2.2.4) leaves two ACME challenges, HTTP-01 (§3.2.2.4.19) and TLS-ALPN-01 (§3.2.2.4.20), unmarked in the Wildcard column, while DNS Change (§3.2.2.4.7) is marked [1]. Let's Encrypt puts it in plain words: HTTP-01 "cannot be used to issue wildcard certificates", and DNS-01 "allows you to issue wildcard certificates" [3]. The rule binds every publicly trusted authority, so a cheap wildcard SSL certificate from a reseller is validated the same way: through DNS or another method marked in that table, never through HTTP-01.

DNS-01 works through a TXT record under _acme-challenge, holding a value derived from the challenge token and the account key [2]. Whoever answers the challenge needs write access to the zone, and needs it again at every renewal. Bridge SSL obtains ACME certificates for sites on Bridge CDN and answers that challenge itself, which it can do where the zone is on Bridge DNS: the platform places the record and removes it, rather than you.

How to get the free wildcard on Bridge CDN

Getting the free wildcard on Bridge CDN takes two actions on your side, in this order:

Add the domain in Bridge CDN. There is no certificate to buy, no key or signing request to prepare and no file to copy.
At the domain's registrar, switch its NS records to Bridge DNS, so the platform can answer DNS-01 for the wildcard.

Bridge CDN terminates TLS and delivers the page, which is why the certificate can live there. The rest is done by the platform:

Bridge SSL proves control: the DNS-01 record is placed, validated and removed, and the domain and *.example.com are issued and presented at the edge.
Subdomains are covered before they exist. The wildcard is issued once the domain's DNS is on Bridge DNS, so the first request to a new name such as shop.example.com does not wait on issuance.
Renewal happens ahead of expiry, by the same layer, proof included. Each issue, renewal and retry is written to the certificate log, per hostname.

Where the free wildcard on Bridge CDN stops

One label. A wildcard in a certificate can only match one label of a hostname [4]. *.example.com covers www.example.com and shop.example.com; a name with more labels in front of example.com is outside it. The platform issues one wildcard per domain, *.example.com, and no second one a level down.
Domain-validated. The certificates prove control of the name. Where a requirement names organisation or extended validation, this is not the mechanism.
No upload. A wildcard certificate you buy elsewhere cannot be installed here; there is no import path.
No choice of authority. The issuing authority is the platform's decision, not a setting.
No time commitment. Issuing and renewal have no published guaranteed time. Keep an outside check on what your hostnames present.
Bridge DNS for the wildcard. With the zone anywhere else, no wildcard is issued, because the platform answers DNS-01 only in a zone it holds.
Bridge CDN only. The free wildcard, like every Bridge SSL certificate, is for hostnames Bridge CDN serves. A site served from its origin directly, or through another CDN, gets nothing from this layer.

Free wildcard on Bridge CDN, ACME client or a bought certificate

Three routes lead to a wildcard. They differ less in the certificate than in who answers the proof and where the result can be used.

Three routes to a wildcard compared
Aspect	Bridge CDN account	Free authority, your ACME client	Commercial authority
Price of the wildcard	included with the account	free at Let's Encrypt [7]	a second, separately priced certificate
Proof of control for the wildcard	DNS-01, answered by the platform	DNS-01, answered by your client, which needs API access to your DNS [3]	a method the Baseline Requirements allow for wildcards; not HTTP-01 [1]
Where the certificate works	hostnames Bridge CDN serves	servers you install it on	servers you install it on
Installation and renewal	nothing to install; renewed by the serving layer	the DNS-01 client, the renewal job and the reload are yours to run and watch	yours, before the expiry date

Which route fits

The free wildcard on Bridge CDN fits a site that is, or can be, served through Bridge CDN with DNS on Bridge DNS, and where subdomains keep appearing: catalogues, APIs with regional names, staging environments that multiply.
An ACME client with a free authority fits when the certificate has to sit on your own servers or behind another CDN, and someone will run and watch the renewal job.
Buy a wildcard certificate when a requirement names organisation or extended validation, or a specific authority. Those are the cases this layer does not cover.

Check what a hostname presents

Renewal moved to the platform; checking stays with you. A check from outside, asking what the hostname presents, shares nothing with the system that renewed the certificate. From any machine with OpenSSL:

openssl s_client -connect shop.example.com:443 -servername shop.example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName

-servername sets the name sent in the TLS SNI extension [5], and -ext subjectAltName prints the names the presented certificate covers [6]. For a one-label subdomain, *.example.com should appear in that list.

FAQ

Is the wildcard SSL certificate really free?

Yes, within a Bridge CDN account: no separate SSL plan, no per-certificate charge and no extra line for wildcards. "Free" means already paid for by the account you have, not free to anyone with no account, and it requires the site to be served through Bridge CDN.

What does a wildcard SSL certificate cost on Bridge CDN?

Nothing on top of the account. The certificate, the wildcard and renewals are included; current terms for the account itself are on the Bridge CDN site.

Can I buy a wildcard cert elsewhere and upload it?

No. Bridge SSL has no import path for a certificate bought elsewhere. If an existing certificate has to be used, this layer is the wrong fit.

Do I need Bridge DNS for the free wildcard?

Yes. The wildcard is proved through DNS-01, and the platform places and removes that record itself, which it does when the domain's DNS is on Bridge DNS.

Sources

Statements about what Bridge CDN does are product statements, kept apart from the protocol facts and checked against the platform before publication; About Bridge SSL describes how.

CA/Browser Forum Baseline Requirements, version 2.3.1, §3.2.2.4: validation methods and the Wildcard column; §3.2.2.4.7, §3.2.2.4.19, §3.2.2.4.20.
RFC 8555, Automatic Certificate Management Environment (ACME), §8.4 DNS Challenge.
Let's Encrypt: Challenge Types: HTTP-01, DNS-01 and wildcards.
RFC 9525, Service Identity in TLS, §6.3.
OpenSSL 3.0 manual, openssl-s_client: -connect, -servername.
OpenSSL 3.0 manual, openssl-x509: -noout, -ext.
Let's Encrypt home page: a certificate authority that provides free TLS certificates.