If you buy a domain, you may think you then have full control over its sub-domains. Well, not necessarily true. As this question and its answers point out, you may need multiple SSL certificates to cover multi-level sub-domains because wildcard matching only works with a single level of sub-domain (ref).
*.example.com will match
foo.example.com but not
I simply cannot figure out the security concerns therein. My best guess is that it may reduce the number of victims when the certificate is compromised. Are there any other valid security benefits from the wildcard matching restriction?
EDIT: Not a dup. The answers to that question are hardly satisfying from a security point of view. They are either too simple or focusing on something else.