This guide compares PositiveSSL Wildcard vs EssentialSSL Wildcard and their single-domain versions, PositiveSSL vs EssentialSSL. All four are domain validation (DV) SSL/TLS certificates from Sectigo, formerly Comodo CA. That’s why some stores still list the wildcards as Comodo PositiveSSL Wildcard and Comodo EssentialSSL Wildcard. Others write Positive SSL and Essential SSL.
Short answer: for most sites, choose PositiveSSL Wildcard, or PositiveSSL for a single domain. It costs less at SSL Dragon, carries Sectigo’s published $50,000 warranty, and has the same encryption and browser trust. EssentialSSL Wildcard makes sense mainly when a client, contract, or specification asks for it by name.
Save 10% on SSL Certificates when ordering from SSL Dragon today!
Fast issuance, strong encryption, 99.99% browser trust, dedicated support, and 25-day money-back guarantee. Coupon code: SAVE10
PositiveSSL Wildcard vs EssentialSSL Wildcard at a Glance
The table below shows where the four certificates differ.
| PositiveSSL Wildcard (DV) | EssentialSSL Wildcard | PositiveSSL (DV) | EssentialSSL | |
|---|---|---|---|---|
| Warranty, total | $50,000 | $10,000 (as listed by SSL Dragon) | $50,000 | $10,000 (as listed by SSL Dragon) |
| Warranty, per transaction | $5,000 | Not confirmed | $5,000 | Not confirmed |
| Price at SSL Dragon, 1 year | $69 | $81 | $9 | $20 |
| Price at SSL Dragon, 3-year plan | $169 ($56.33/yr) | $206 ($68.66/yr) | $23 ($7.66/yr) | $50 ($16.66/yr) |
The table below shows what they share.
| Wildcards | Single-domain | |
|---|---|---|
| Issuer and validation | Sectigo, domain validation (DV) | Same as wildcards |
| Covers | Unlimited first-level subdomains, usually plus the base domain | One domain, with and without www |
| Validation methods | DNS or email | DNS, email, or HTTP file |
| Certificate validity | Up to 199 days per certificate, with free reissues for your plan (1-3 years) | Same as wildcards |
| Issuance | Within minutes of completing validation | Same as wildcards |
| Keys and encryption | RSA 2048-bit or larger, or ECC; the same encryption on all four | Same as wildcards |
| Browser trust | All major browsers (Sectigo roots) | Same as wildcards |
| Site seal | A free site seal for your pages | Same as wildcards |
| Server licenses | Unlimited | Same as wildcards |
| Refund at SSL Dragon | 25-day refund policy | Same as wildcards |
What’s Actually Different
At SSL Dragon, EssentialSSL Wildcard costs $12 more than PositiveSSL Wildcard for one year and $37 more over a 3-year plan. That difference doesn’t buy stronger encryption or a stricter check; the two differ in warranty terms and product line.
The Warranty
PositiveSSL and PositiveSSL Wildcard come with a $50,000 relying-party warranty, capped at $5,000 per transaction, under Sectigo’s Relying Party Agreement v2.6.
The warranty doesn’t pay you, the site owner. It covers a visitor, a person rather than a company, who loses money on an online card or bank payment because Sectigo didn’t validate the certificate with reasonable care. The visitor has to claim while the certificate is valid and within 30 days of learning about the loss. They also must have read the agreement before relying on the certificate and must dispute the charge with their bank first. If a visitor lost $8,000 on one payment, the most PositiveSSL’s warranty could pay is $5,000. The $50,000 total starts again when you renew.
It doesn’t cover hacks or data breaches on your server. Those conditions make a payout unlikely, so don’t choose a certificate for its warranty alone.
The Product Line
The two lines differ in status today. PositiveSSL is Sectigo’s own budget brand. EssentialSSL is a Comodo-era line that resellers still sell, and Sectigo’s current documents don’t list it.
PositiveSSL vs EssentialSSL: The Single-Domain Versions
The single-domain certificates follow the same pattern. Single-domain PositiveSSL and EssentialSSL share the wildcards’ DV validation, encryption, and warranty terms. The price gap is wider in proportion, though: EssentialSSL costs more than twice as much (see the table). Each covers one domain with and without www, and you can also validate it with an HTTP file. If you only need your main domain, either single-domain certificate costs far less than a wildcard.
Can Your Visitors Tell Which One You Bought?
Not from the certificate. Sectigo stopped writing product names such as “PositiveSSL” into DV certificates in December 2019 (Sectigo notice), and since September 2022 industry rules have banned the field that held them (ballot SC47v2). A DV certificate now names only your domain. Browsers show PositiveSSL Wildcard and EssentialSSL Wildcard the same way, and both are issued by Sectigo.
Both lines also include a free site seal you can add to your pages. A seal is an image; it doesn’t change how browsers treat the connection. So the idea that EssentialSSL Wildcard looks more professional has nothing in the certificate to back it.
What Both Certificates Share
Both are domain validation certificates. Sectigo checks that you control the domain, not who runs the business, so neither shows a company name.
A wildcard for *.example.com covers shop.example.com and mail.example.com, and usually example.com itself. It doesn’t cover dev.shop.example.com; that level needs another certificate (see multi-level subdomains).
Wildcards can’t be validated with an HTTP file, an option that ended in 2021. Plan for a DNS record or an email to an address such as admin@ at your domain (domain control validation explains each method).
Encryption and key options are identical. You can also install either certificate on as many servers as you need. That’s convenient, but every server then holds the same private key, so a leak on one server exposes them all. Reissues are free for the length of your plan.
Save 10% on SSL Certificates when ordering from SSL Dragon today!
Fast issuance, strong encryption, 99.99% browser trust, dedicated support, and 25-day money-back guarantee. Coupon code: SAVE10
How Certificate Lifetimes Are Changing
Since March 12, 2026, Sectigo has issued certificates for at most 199 days (Sectigo notice). The CA/Browser Forum, whose rules browsers enforce, lowers the maximum again (ballot SC-081v3): to 100 days on March 15, 2027, and to 47 days on March 15, 2029 (certificate validity period).
That makes every plan, even a 1-year one, a subscription: you install a new certificate before each one expires, and those reissues are free.
| Plan | Minimum installs, reissuing at each expiry |
|---|---|
| 1 year | 3 |
| 2 years | 7 |
| 3 years | 13 |
Sectigo reuses a completed validation for up to 198 days, so expect to validate the domain again at most reissues. Email validation ends on March 15, 2028 (ballot SC-090), so set up DNS validation for a wildcard now. Automation needs an ACME product, which SSL Dragon sells separately; see how ACME automation works.
Which One Should You Choose?
For most sites, PositiveSSL Wildcard is the better buy. It costs less and carries the warranty Sectigo publishes for its own brand. Personal sites, blogs, portfolios, and small business sites get the same encryption and browser trust either way.
EssentialSSL Wildcard earns its place when something outside your control names it, such as a client specification, a contract, or a procurement list. In that case, the higher price pays for meeting that requirement, not for better protection.
For one domain the same rule applies, so choose PositiveSSL unless a client or a contract requires EssentialSSL.
If Neither Fits
- Several root domains, each with subdomains: PositiveSSL Multi-Domain Wildcard
- Your company name in the certificate: an OV wildcard certificate
- A contract requiring a larger warranty: a higher-warranty Sectigo wildcard
Or compare wildcard SSL certificates and Sectigo SSL certificates.
Claims You’ll Read Elsewhere
Some comparison pages repeat claims that are out of date or were never true:
- “PositiveSSL carries a $10,000 warranty.” Sectigo’s agreement lists $50,000 (RPA v2.6).
- “EssentialSSL has stronger encryption or higher validation.” Both are DV certificates with the same key options (Baseline Requirements §6.1.5).
- “Wildcards can be validated with an HTTP file.” Not since 2021 (Baseline Requirements, domain validation methods).
- “EssentialSSL includes a PCI scan.” Not at SSL Dragon, where our EssentialSSL Wildcard listing includes none.
FAQ
No. Both are Sectigo DV certificates with the same validation, encryption, and browser trust. PositiveSSL costs less and is the brand Sectigo names in its published warranty schedule. EssentialSSL is the better pick only when a client, a contract, or a specification requires that name.
Mainly the name. EssentialSSL has no larger warranty or stronger encryption, and both lines include a free site seal. Resellers set their own prices, and Sectigo publishes no retail price for it, so the price gap varies from store to store.
It doesn’t. The warranty covers your visitors, not you, and only for card or bank losses caused by Sectigo issuing a certificate in error. Breaches on your server or in your application aren’t covered. The conditions are in the warranty section above.
Yes. When you renew, you can order either one. Nothing changes in the certificate your visitors see. You validate the domain and install the new certificate, the same steps as any renewal.
They aren’t going away: the industry rules still allow them, though their lifetimes are shrinking like every certificate’s. The encryption is no weaker either. The extra risk is in how wildcards are used: if one wildcard runs on many servers, a leaked private key on any of them exposes every subdomain.
Save 10% on SSL Certificates when ordering from SSL Dragon today!
Fast issuance, strong encryption, 99.99% browser trust, dedicated support, and 25-day money-back guarantee. Coupon code: SAVE10
