Annoyingly, TLS wildcards have very a different meaning to DNS wildcards.<p>DNS wildcards only work when * is the leftmost label of a domain name, so<p><pre><code>    *.example.com is a wildcard
    foo.*.example.com is not a wildcard
    *bar.example.com is not a wildcard
</code></pre>
A DNS wildcard matches any non-zero number of labels, so<p><pre><code>    *.example.com
    foo.example.com matches
    foo.bar.example.com matches
    example.com does not match
</code></pre>
RFC 4592 describes DNS wildcards.<p>Unlike the DNS, the * in a TLS certificate can only match one label, so<p><pre><code>    *.example.com
    foo.example.com matches
    foo.bar.example.com does NOT match
    example.com does not match
</code></pre>
RFC 2818 also allows the * to appear within a domain name, not just as the leftmost label, and wildcards work even when they are part of a label. One of its examples says<p><pre><code>    f*.com
    foo.com matches
    bar.com does not match
</code></pre>
But nowadays sub-label wildcards like this are not supported.