> Offtopic but related question: is there any TLD for which a first-level wildcard is allowed in SSL certs? Nope (unless you own "an entire gTLD"). From the C

> Offtopic but related question: is there any TLD for which a first-level wildcard is allowed in SSL certs? Nope (unless you own "an entire gTLD"). From the CA/Browser Forum's Baseline Requirements (v1.7.3) [0] (with a few links/references added): -- 3.2.2.6 Wildcard Domain Validation Before issuing a certificate with a wildcard character (*) in a CN or subjectAltName of type DNS-ID, the CA MUST establish and follow a documented procedure that determines if the wildcard character occurs in the first label position to the left of a “registry-controlled” label or “public suffix” (e.g. “*.com”, “*.co.uk”, see RFC 6454 Section 8.2 [1] for further explanation). If a wildcard would fall within the label immediately to the left of a registry-controlled /1 or public suffix, CAs MUST refuse issuance unless the applicant proves its rightful control of the entire Domain Namespace. (e.g. CAs MUST NOT issue “*.co.uk” or “*.local”, but MAY issue “*.example.com” to Example Co.). Determination of what is “registry-controlled” versus the registerable portion of a Country Code Top-Level Domain Namespace is not standardized at the time of writing and is not a property of the DNS itself. Current best practice is to consult a “public suffix list” such as the Public Suffix List (PSL) [2,3, and to retrieve a fresh copy regularly. If using the PSL, a CA SHOULD consult the “ICANN DOMAINS” section only, not the “PRIVATE DOMAINS” section. The PSL is updated regularly to contain new gTLDs delegated by ICANN, which are listed in the “ICANN DOMAINS” section. A CA is not prohibited from issuing a Wildcard Certificate to the Registrant of an entire gTLD, provided that control of the entire namespace is demonstrated in an appropriate way. -- [0]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.3.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... (PDF) [1]: https://tools.ietf.org/html/rfc6454#section-8.2 https://tools.ietf.org/html/rfc6454#section-8.2 [2]: https://publicsuffix.org/ https://publicsuffix.org/ [3]: https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat