Wildcard certificate — know the scope

What's going on

A name like *.example.com covers www.example.com and api.example.com, but NOT example.com itself and NOT a.b.example.com — one label only. And one private key now protects every matching host: leak it once, lose them all.

How to fix it

Nothing to 'fix' — this is an informational note. If the bare domain must be covered too, the certificate needs example.com listed alongside *.example.com. For higher-value estates, prefer per-service certificates (free automation makes this painless) so one leaked key doesn't expose everything.

New to certificates? Start with the guide: How to read an SSL certificate.