AFAIK, all major browsers follow RFC 6125 which says that only single-level wildcards are supported.<p><a href="https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc6125#section-6.4.3" rel="nofollow">https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc6125#section-6.4.3</a><p><a href="https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=646613" rel="nofollow">https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=646613</a><p><a href="https:&#x2F;&#x2F;code.google.com&#x2F;p&#x2F;chromium&#x2F;issues&#x2F;detail?id=70517" rel="nofollow">https:&#x2F;&#x2F;code.google.com&#x2F;p&#x2F;chromium&#x2F;issues&#x2F;detail?id=70517</a><p>Your best bet is probably to wait for Let&#x27;s Encrypt to be generally available, so that you can automatically generate a separate certificate for every hostname.