title: TLS implementation: (Using LibreSSL library) Failing handshake on client side when server certificate has wildcard SAN of type: *test.example.com
body: <p><strong>Problem:</strong></p>
  <p>Server:
  Subject Alternative Name(SAN) in server certificate: *<strong>test.example.com</strong></p>
  <p>Client:
  Server Name Indicator(SNI) given from client side: <strong>mytest.example.com</strong></p>
  <p>Result: <strong>handshake fail!</strong></p>
  <hr />
  <p>Although for similar scenario,</p>
  <p>Subject Alternative Name(SAN) in server certificate: *<strong>.example.com</strong></p>
  <p>Client:
  Server Name Indicator(SNI) given from client side: <strong>mytest.example.com</strong></p>
  <p>Result: <strong>handshake successful!</strong></p>
  <hr />
  <p><strong>Query:</strong></p>
  <p>I <strong>need to conduct successful handshake for</strong> SAN *<strong>test.example.com.</strong>
  I'm guessing Openbsd must have an option to make the first match (which is failing now) valid. Can someone please help me with this.</p>
  <hr />
  <p><strong>What RFC has to say: (RFC 6125 Sec: 6.4.3)</strong>
  The client <strong>MAY</strong> match a presented identifier in which the wildcard character is not the only character of the label (e.g., baz*.example.net and <em>baz.example.net and b</em>z.example.net would be taken to match baz1.example.net and foobaz.example.net and buzz.example.net, respectively). However, the client SHOULD NOT attempt to match a presented identifier where the wildcard character is embedded within an A-label or U-label [IDNA-DEFS] of an internationalized domain name [IDNA-PROTO].</p>
  <p>Thanks in advance.</p>