Yes it does, due to the way that it’s structured. AFAICT, the wildcard symbol (asterisk) will not match across the separator (i.e. the period). So ¤.¤ will on

Yes it does, due to the way that it’s structured. AFAICT, the wildcard symbol (asterisk) will not match across the separator (i.e. the period). So ¤.¤ will only match example.com or contoso.com etc, not blog.example.com or sales.contoso.com. If you look at the cert, it has lots of line that looks like this: DNS:¤.¤.¤.¤.¤.¤.¤.¤.¤.¤, DNS:¤.¤.¤.¤.¤.¤.¤.¤.¤.¤.¤, In that way it will match all possible levels of subdomains. (Asterisk substituted for ¤ in order to not trip up the formatting here on HN.)