Re: [TLS] RFC 2818 wildcard rationale

[Chris Richardson <[e-mail]>]

> Regarding #1, if * matched multiple labels, it would match
> www.yourbank.com.whatever.example.com, which would be a very bad thing since
> it can mislead users into thinking that they are visiting
> "www.yourbank.com".

Are there any circumstances under which an (individual/organization)
is authorized to have a certificate for *.example.com, but is not
authorized to have a certificate for
www.yourbank.com.whatever.example.com?

> Regarding #2, I don't think that would introduce any real badness, except
> having to edit the rulestring, which make already complex logic more
> complex, and more likely to fail an unsecure manner (there is also the fact
> that you can have "f*.example.com", which should not allow #2 to be
> generated, causing more complexity). However, adding a separate rule for
> "example.com" in the SAN field is very simple.

If both (1) and (2) were allowed, that would eliminate the need for
wildcards which should simplify the logic.

And out of curiousity, are there any real examples of f*.example.com
certificates?  Are there any circumstances under which that is a good
idea?