title: Self-signed certificate: DNSName components must begin with a letter
body: <p>Is there a way for java's keytool to generate self-signed certificate with a wildcard in SAN (Subject Alternative Name)? I'm using this command to generate keystore:</p>
  
  <pre><code>keytool -genkey -alias tomcat -storetype JKS -keyalg RSA -keysize 2048 -ext san=dns:*.example.com -keystore "path/to/my/keystore.jks" -validity 3650
  </code></pre>
  
  <p>But I get <code>IOException: DNSName components must begin with a letter</code></p>
  
  <p>Obviously, the problem is <code>*.example.com</code> in SAN, but I don't see other way of generating self-signed certificate for <code>example.com</code> subdomains.</p>
  
  <p>According to <a href="https://webmasters.stackexchange.com/a/32818">this</a>, it should be possible. Is it error in my syntax, bug in keytool, or I misunderstood something?</p>
  
  <p>BTW, I'm using keytool from JDK 1.8 update 60</p>
  
  <p><strong>EDIT</strong> I managed to generate self-signed certificate for all <code>example.com</code> subdomains via keytool by specifying <code>CN=*.example.com</code>, and leaving SAN empty. Nonetheless, I'll leave Omikron's answer as accepted (since it's an actual answer and not a bypass of restrictions).</p>