---
title: "Multi-domain & wildcards — Certificates for Laravel | Roundly"
description: "Cover several hostnames or a wildcard with one SAN certificate, and find the certificate that covers any given host."
url: https://roundly-consulting.com/open-source/docs/certificates-for-laravel/multi-domain
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Certificates for Laravel](https://roundly-consulting.com/open-source/docs/certificates-for-laravel.md)

# Multi-domain & wildcards

Issue one certificate for several domains by passing an array to for(), or append SANs fluently with alsoFor(). Wildcards are supported — on the acme driver only over DNS-01:

```php
// requires a DnsChallengeSolver in drivers.acme.solver
Certificates::for(['app.example.com', '*.app.example.com'])->using('acme')->issue();

Certificates::for('example.com')
    ->alsoFor('www.example.com', 'api.example.com')
    ->using('acme')
    ->issue();
```

The first domain is the primary: it is stored on the domain column and drives the derived certificate name. When more than one domain is requested, the full list is stored on the additive domains JSON column.

## Finding the covering certificate

The coveringDomain scope matches rows whose primary domain equals the host or whose SAN list contains it:

```php
use RoundlyConsulting\Certificates\Models\Certificate;

$certificate = Certificate::query()->coveringDomain('www.example.com')->first();

$certificate->domain;   // 'example.com' — the primary domain
$certificate->domains;  // ['example.com', 'www.example.com', 'api.example.com']
```

issueIfMissing(), status() (on the facade and the builder) and hasCertificateFor() use the same covering lookup, so issueIfMissing('www.shop.example.com') returns an active certificate for shop.example.com + www.shop.example.com instead of issuing a duplicate. find(), certificateFor(), renew(), revoke() and expire() match the primary domain exactly.

## Driver support

Drivers that implement ProvisionsMultipleDomains — acme, filesystem, kubernetes and array — receive the full list in one generateMany() call: one ACME order, one self-signed certificate or one Ingress TLS entry. Others (null, or a custom driver without the interface) fall back to the primary domain. Every domain is lowercased, de-duplicated and validated with ValidDomain first; \*. wildcards pass by default. A renewal re-provisions every domain the certificate covers, so a SAN certificate keeps all its hosts.

CAs, Let’s Encrypt included, never offer HTTP-01 for a \*. name, so register a DNS-01 solver first — see ACME & Let’s Encrypt. With the default HTTP-01 solver a wildcard order fails with an AcmeException that says so.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/certificates-for-laravel.md)