Is or was it possible to register a wildcard certificate to third level subdomain?

Question

The use of a null byte in a certificate cn is very well known…

and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of thing) :

static bool
does_name_match(const char * name, const char * pat) {
char * cp;
return *pat == '*'      /* possible wildcard match */
  ?    *++pat == '.'        /* starts star, dot              */
    && !strchr(++pat, '*')  /* has no more stars             */
    && strchr(pat, '.') /* and has another dot.          */
    && (cp = strchr(name, '.'))/* The name has at least one dot */
    && strcmp(++cp, pat) == 0 /* and we only compare after it. */
  :    !strchr(pat+1, '*')
    && strcmp(name, pat) == 0;
}

which will prevent the recognition of*.\0.thoughtcrime.orgor*.*\0.thoughtcrime.orgwithtip.emailwill trigger a match in the case of*.fmm.email\0.thoughtcrime.orgwithmail.fmm.email

So is it, or was it, possible to register something like*.e10000.biz\0.thoughtcrime.org (since e10000 and biz can be considered as usual words and not only subdomain)

Answer 1

Looking at google certificate’s, it’s now very clear…

The answer is yes of course since you can request to be a certificate authority for the domains you control…