diff --git a/plugins/nginx-vhosts/commands b/plugins/nginx-vhosts/commands
index 1d0a9db23..a75745871 100755
--- a/plugins/nginx-vhosts/commands
+++ b/plugins/nginx-vhosts/commands
@@ -52,14 +52,18 @@ EOF
         SCHEME="https"
 
         SSL_HOSTNAME=$(openssl x509 -in $SSL_INUSE/server.crt -noout -subject | tr '/' '\n' | grep CN= | cut -c4-)
-        SSL_HOSTNAME=$(echo "$SSL_HOSTNAME" | sed 's|\.|\\.|g' | sed 's/\*/\.\*/g')
-        [[ -z "$(egrep ^"$SSL_HOSTNAME"$ $VHOST_PATH)" ]] && echo "$SSL_HOSTNAME" | sed 's/\\./\./g' >> $VHOST_PATH
+        if [[ -n "$SSL_HOSTNAME" ]]; then
+          SSL_HOSTNAME_REGEX=$(echo "$SSL_HOSTNAME" | sed 's|\.|\\.|g' | sed 's/\*/\.\*/g')
+          [[ -z "$(egrep "^${SSL_HOSTNAME_REGEX}$" $VHOST_PATH)" ]] && echo "$SSL_HOSTNAME" >> $VHOST_PATH
+        fi
 
         SSL_HOSTNAME_ALT=$(openssl x509 -in $SSL_INUSE/server.crt -noout -text | grep --after-context=1 '509v3 Subject Alternative Name:' | tail -n 1 | sed -e "s/[[:space:]]*DNS://g"  | tr ',' '\n' || true)
-        SSL_HOSTNAME_ALT=$(echo "$SSL_HOSTNAME_ALT" | sed 's|\.|\\.|g' | sed 's/\*/\.\*/g')
-        [[ -z "$(egrep ^"$SSL_HOSTNAME_ALT"$ $VHOST_PATH)" ]] && echo "$SSL_HOSTNAME_ALT" | sed 's/\\./\./g' >> $VHOST_PATH
+        if [[ -n "$SSL_HOSTNAME_ALT" ]]; then
+          SSL_HOSTNAME_ALT_REGEX=$(echo "$SSL_HOSTNAME_ALT" | sed 's|\.|\\.|g' | sed 's/\*/\.\*/g')
+          [[ -z "$(egrep "^${SSL_HOSTNAME_ALT_REGEX}$" $VHOST_PATH)" ]] && echo "$SSL_HOSTNAME_ALT" >> $VHOST_PATH
+        fi
 
-        SSL_VHOSTS=$(egrep "^${SSL_HOSTNAME}$|^${SSL_HOSTNAME_ALT}$" $VHOST_PATH || exit 0)
+        SSL_VHOSTS=$(egrep "^${SSL_HOSTNAME_REGEX}$|^${SSL_HOSTNAME_ALT_REGEX}$" $VHOST_PATH || exit 0)
         NONSSL_VHOSTS=$(egrep -v "^${SSL_HOSTNAME}$|^${SSL_HOSTNAME_ALT}$" $VHOST_PATH || exit 0)
 
         while read line; do
diff --git a/tests/unit/00_dokku-standard.bats b/tests/unit/00_dokku-standard.bats
index c8abfbfba..cb9857e39 100644
--- a/tests/unit/00_dokku-standard.bats
+++ b/tests/unit/00_dokku-standard.bats
@@ -9,6 +9,7 @@ setup() {
 teardown() {
   rm -rf /home/dokku/$TEST_APP/tls /home/dokku/tls
   destroy_app
+  disable_tls_wildcard
 }
 
 @test "run (with tty)" {
@@ -35,8 +36,7 @@ teardown() {
 }
 
 @test "urls (app ssl)" {
-  mkdir -p /home/dokku/$TEST_APP/tls
-  touch /home/dokku/$TEST_APP/tls/server.crt /home/dokku/$TEST_APP/tls/server.key
+  setup_test_tls
   run bash -c "dokku urls $TEST_APP | grep dokku.me"
   echo "output: "$output
   echo "status: "$status
@@ -44,8 +44,7 @@ teardown() {
 }
 
 @test "urls (wildcard ssl)" {
-  mkdir -p /home/dokku/tls
-  touch /home/dokku/tls/server.crt /home/dokku/tls/server.key
+  setup_test_tls_wildcard
   run bash -c "dokku urls $TEST_APP | grep dokku.me"
   echo "output: "$output
   echo "status: "$status
diff --git a/tests/unit/nginx-vhosts.bats b/tests/unit/nginx-vhosts.bats
index 0c6f09db1..8c9660a48 100644
--- a/tests/unit/nginx-vhosts.bats
+++ b/tests/unit/nginx-vhosts.bats
@@ -12,6 +12,7 @@ teardown() {
   destroy_app
   [[ -f "$DOKKU_ROOT/VHOST.bak" ]] && mv "$DOKKU_ROOT/VHOST.bak" "$DOKKU_ROOT/VHOST"
   [[ -f "$DOKKU_ROOT/HOSTNAME.bak" ]] && mv "$DOKKU_ROOT/HOSTNAME.bak" "$DOKKU_ROOT/HOSTNAME"
+  disable_tls_wildcard
 }
 
 @test "nginx (no server tokens)" {
@@ -22,6 +23,21 @@ teardown() {
   assert_failure
 }
 
+@test "nginx:build-config (wildcard SSL)" {
+  destroy_app
+  setup_test_tls_wildcard
+  create_app
+  run dokku domains:add $TEST_APP wildcard.dokku.me
+  echo "output: "$output
+  echo "status: "$status
+  assert_success
+  deploy_app
+  run bash -c "response=\"$(curl -LkSs wildcard.dokku.me)\"; echo \$response; test \"\$response\" == \"nodejs/express\""
+  echo "output: "$output
+  echo "status: "$status
+  assert_success
+}
+
 @test "nginx:build-config (with SSL CN mismatch)" {
   setup_test_tls
   deploy_app
diff --git a/tests/unit/server_ssl_wildcard.tar b/tests/unit/server_ssl_wildcard.tar
new file mode 100644
index 000000000..0fa52c4ee
Binary files /dev/null and b/tests/unit/server_ssl_wildcard.tar differ
diff --git a/tests/unit/test_helper.bash b/tests/unit/test_helper.bash
index f3f7a5a7f..08b05c45a 100644
--- a/tests/unit/test_helper.bash
+++ b/tests/unit/test_helper.bash
@@ -134,3 +134,21 @@ setup_test_tls_with_sans() {
   tar xf $BATS_TEST_DIRNAME/server_ssl_sans.tar -C $TLS
   sudo chown -R dokku:dokku $TLS
 }
+
+setup_test_tls_wildcard() {
+  TLS="/home/dokku/tls"
+  mkdir -p $TLS
+  tar xf $BATS_TEST_DIRNAME/server_ssl_wildcard.tar -C $TLS
+  sudo chown -R dokku:dokku $TLS
+  sed -i -e "s:^# ssl_certificate $DOKKU_ROOT/tls/server.crt;:ssl_certificate $DOKKU_ROOT/tls/server.crt;:g" \
+         -e "s:^# ssl_certificate_key $DOKKU_ROOT/tls/server.key;:ssl_certificate_key $DOKKU_ROOT/tls/server.key;:g" /etc/nginx/conf.d/dokku.conf
+  kill -HUP "$(< /var/run/nginx.pid)"; sleep 5
+}
+
+disable_tls_wildcard() {
+  TLS="/home/dokku/tls"
+  rm -rf $TLS
+  sed -i -e "s:^ssl_certificate $DOKKU_ROOT/tls/server.crt;:# ssl_certificate $DOKKU_ROOT/tls/server.crt;:g" \
+         -e "s:^ssl_certificate_key $DOKKU_ROOT/tls/server.key;:# ssl_certificate_key $DOKKU_ROOT/tls/server.key;:g" /etc/nginx/conf.d/dokku.conf
+  kill -HUP "$(< /var/run/nginx.pid)"; sleep 5
+}