What are wildcard certificate limitations in SAN extension?

Question

Consider following example:

We created own CA certificate (self-signed) and imported into browser trust store. We signed certificate by this CA certificate with SAN extension with following domains:

• DNS: *.dev
• DNS: *.*.dev

No matter if CN is present in certificate or even whole DN is missing. Still getting following errors in browsers when accessing domain https://test.dev:

Firefox 45.8.0:

test.dev uses an invalid security certificate. The certificate is only valid for the following names: *.dev, *.*.dev Error code: SSL_ERROR_BAD_CERT_DOMAIN

Chrome 58.0.3029.81 (64-bit):

NET::ERR_CERT_COMMON_NAME_INVALID

There is only one working wildcard in SAN for third level domain, when browsers accepts connection:

• DNS: *.secondlevel.dev

Multilevel wildcard in SAN is not accepted by browsers:

• DNS: *.*.secondlevel.dev

Is there a way to have multilevel wildcard in SAN extension or what are limitations for wildcards in SAN extensions?

Answer 1

From RFC 6125:

The client SHOULD NOT attempt to match a presented identifier in which the wildcard character comprises a label other than the left-most label (e.g., do not match bar.*.example.net).

Thus, wildcard is only allowed in the left-most label which automatically restricts it to at most one level of wildcard.

A similar restriction can also be found in the CA/Browser Forum Baseline Requirements 1.4.2 which combined with other definitions in the document restricts the wildcard to only the left-most label:

Wildcard Certificate:
A Certificate containing an asterisk (*) in the left‐most position of any of the Subject Fully‐Qualified Domain Names contained in the Certificate.

Apart from that the CA/Browser Forum Baseline Requirements have more restrictions which result in *.dev not working since dev is in the public suffix list:

CAs SHALL revoke any certificate where wildcard character occurs in the first label position immediately to the left of a “registry‐controlled” label or “public suffix”.

For more information see section "3.2.2.6 Wildcard Domain Validation" of the Baseline Requirements.