I think this is more of an opinion based question but I am writing this answer based on my experience. Let's start with understanding the Wildcard Cert and Multi-Domain/SANS certs.
Wildcard Cert - A Wildcard SSL Certificate allows users to secure an unlimited number of sub-domains, at a specific level, for one domain on one certificate. for example, Sitecore is using sitecore.net as a wildcard Certificate, it has multiple subdomains such as
Multi-Domain/SANS certs - A Multi-Domain SSL certificate allows users to secure multiple Fully Qualified Domain Names (FQDN) on one or more certificate. This means you may have one or more certificates with multiple domains. For example, if you have multiple websites with different-different domains in that case you need to use Multi-Domain Certification.
When a certificate only has one SAN field and it contains a reference to a single website, then it’s a single-domain certificate. If that one SAN field contains an asterisk in the website name (e.g. ‘*.yourwebsite.com’) then it’s a wildcard certificate. If the certificate has many SAN fields, then it’s a multi-domain certificate. Multi-domain certificates sometimes have 100 or more SAN fields, and some or all of these fields may contain wildcards, creating a hybrid “multi-domain wildcard” certificate.
There are no specific pons and cons, it depends on your requirements. If you have a specific requirement of multiple domains or you want a separate domain for each environment then you can go with multi-domain certificate. But generally, we use subdomains for the different-different environment and use single domain wild-card certificates such as
The best option is to use the multi-domain wildcard certificate when you have a multi-domain website with multiple environments. for example, you have 3 brands website with different domain
brand3.com as public websites, and multiple environments such as DEV, TEST, and PROD with main website
mainbrand.com. In this case, you will have wildcard SAN fields for
*.mainbrand.com and single entries for other public websites. You can use the same wildcard for your xConnect and Solr as well.