Wildcard certificate
A wildcard certificate covers every hostname at one level beneath a domain.
*.example.com covers www.example.com, api.example.com and
anything.example.com.
The two things it does not cover
Deeper levels. *.example.com does not cover a.b.example.com. One
wildcard, one level. Covering two levels needs a second wildcard
(*.b.example.com) as a separate SAN entry.
The apex. *.example.com does not cover example.com itself. Certificates
that appear to do both list the apex explicitly as an additional SAN — and one
issued without it produces a warning on the bare domain while every subdomain
works, which is a confusing morning.
The trade-off nobody states
A wildcard is one certificate to renew instead of forty, which is genuinely easier. It is also one private key that authenticates every host under the domain — so it ends up copied onto every server that needs it, including the ones with the weakest access controls.
Per-host certificates are more work and blast-radius-limited. Automated issuance has made the "more work" argument much weaker than it was.
Related
Check what a certificate actually covers with the SSL certificate checker.
See also: SAN, CAA record.