ssl - What is the format of wildcard certificate name?

Question

I'm writing validation of SSL certificates and I'd like to know the format of certificate names with wildcards. From the RFC 2818:

Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., .a.com matches foo.a.com but not bar.foo.a.com. f.com matches foo.com but not bar.com.

Is it possible for the wildcard character to appear in the middle of the name? Also can I use a few of them in one name?

hello.*.a.com
*.*.a.com

I understand that it may not be practically useful, but I want to know what is technically possible.

Answer 1

I recommend you use the newer RFC 6125 instead of RFC 2818. This RFC make wildcard handling more clear. Essentially it means:

• Only left-most labels, i.e. *.example.com but not www.*.com. This implicitly excludes multiple wildcards like *.*.example.com.
• A wildcard label can be matched only against a single label, i.e. *.example.com will match www.example.com but not sub.www.example.com.
• If the wildcard is not the full label (i.e. w*.example.com) it should not occur inside IDNA labels.

That's about what is implemented in the browsers today. Apart from that you'll find more restrictions like no wildcards for top-level and second-level (i.e. no * or *.com) and sometimes more restrictions like no wildcards for *.co.uk.

Also have a look at CAB Baseline Requirements, section 3.2.2.6.