[TLS] RFC 2818 wildcard rationale

[Chris Richardson <[e-mail]>]

RFC 2818 states:

Names may contain the wildcard
character * which is considered to match any single domain name
component or component fragment. E.g., *.a.com matches foo.a.com but
not bar.foo.a.com.

I was trying to figure out the rationale behind this, but have been
unable to do so.  I was hoping someone could enlighten me.

Suppose that:
(1): *.example.com matched a.b.example.com
(2): *.example.com matched example.com.

What security problems exist with (1) and/or (2) that are solved by
following the rules of 2818?  Anything more than preventing a single *
from matching the entire internet?


 -- Chris