Yes, I do agree with you brokt,
GeoTrust Wildcard SSL can secure your wp.example.com for free when you order for *.wp.example.com
Check this link
https://www.geotrust.com/ssl/wildcard-ssl-certificates/
http://www.clickssl.com/ssl-certificates/geotrust/truebusinessid-wildcard
Do you enable ssl on wp login page?
If not then try it because this is not happened because of your Wildcard SSL Certificate
In wordpress your every subdomains have private wp admin and wp login page so you need to enable ssl in every login or admin pages also.
Wildcard SSL secures your primary domain name (wp.example.com) or unlimited sub domain for that primary domain name (*.wp.example.com)
Here is the link which will explain you more detail on Wildcard SSL Certificate: https://www.clickssl.com/blog/what-is-wildcard-ssl-certificate/
Hope you will find your answer.
