SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-wildcard-certificate

A wildcard certificate for *.example.com is presented. Which name does it match?

www.example.com, because the wildcard matches exactly one left-most label.

Start playing free

  1. www.example.org
  2. www.example.com ✔
  3. a.b.example.com

Why: The wildcard can only be the whole left-most label and covers just one label. So a.b.example.com, with two labels, does not match.

Huh, didn't know that: RFC 9525 says only one wildcard character is allowed and it must be the complete left-most label.

The dad joke
Why did the football team fumble the handoff? They didn't use a secure transfer method.
Like this card?
Play the game

References

Answer: www.example.com. The wildcard can only be the whole left-most label and covers just one label. So a.b.example.com, with two labels, does not match.

  1. RFC 9525, Service Identity in TLS www.rfc-editor.org/rfc/rfc9525
    A wildcard in a presented identifier can only match one label in a reference identifier.
    Checked 2026-10-10.
  2. RFC 9525, Service Identity in TLS www.rfc-editor.org/rfc/rfc9525
    The wildcard character appears only as the complete content of the left-most label.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat do you send to a certificate authority to request a certificate?Security & PrivacyWhat did TLS 1.3 change about key exchange?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?

That's stuff everyone should know.