But let's say I had two severs. One that hosts 1000 different subdomains, so I give it a wildcard cert, as 1000 SAN entries would be absurd. The second server

But let's say I had two severs. One that hosts 1000 different subdomains, so I give it a wildcard cert, as 1000 SAN entries would be absurd. The second server hosts one subhuman, and has a specific cert for it. Would Firefox try to send a request for that seperate subhuman to my big wildcard server? That sounds very wrong! It is also possible that I had configured that wildcard server to host up some default site for unknown hostnames. Perhaps that default site exists to tell people how to report a problem if they see it, as with 1000 subdomains it would be very easily for there to be an accidental mismatch between the name in DNS and the name in the nginx config, especially if relevant automation has not been built up yet. I'd see that as an absolute bug, regardless of what the spec says (and the bug report does has some people disputing the spec allows doing this without checking DNS first). Although I suppose it is possible that Firefox won't do this for wildcards, but only for explicitly listed SAN names? Which is better but still quite odd seeming to me.