*.net? How about
The RFC 2818 does not say anything about this topic.
Yes, it can be issued.
Luckily the common browsers do not accept wildcard certificates for TLDs.
IE even rejects *.co.uk, but I am pretty sure the list is not complete.
In the list of fake certificates issued by DigiNotar, there is "*.*.com". This is obviously an attempt to get around the restriction.
I have tested this on common browsers, the three big ones (on windows anyways) don't accept this. What I haven't done is try it on the mobile platforms which imo are the real target of this attack. Since iOS doesn't have a way to revoke certificates there are millions of i-devices out there that are vulnerable until apple releases a patch, and they apply it.
Obvious places to try this with high impact: Activesync to exchange, ssl vpn clients, safari on idevices, stock browser on androids.