There's general consensus in the Web PKI world that wildcards in certificates were a mistake. RFC 6125 has an entire section dedicated to security consideration

There's general consensus in the Web PKI world that wildcards in certificates were a mistake. RFC 6125 has an entire section dedicated to security considerations[1]. > For no reason as far as I know. Who owns domain.com but not bla.domain.com? Many, many services[2]. DNS is fundamentally hierarchical, but not in a way that implies authority or control: the owners/operators of `com.` should not be able to obtain a wildcard certificate for `*.com.` and thereby read the traffic of `google.com`, `facebook.com`, etc. [1]: https://datatracker.ietf.org/doc/html/rfc6125#section-7.2 https://datatracker.ietf.org/doc/html/rfc6125#section-7.2 [2]: https://en.wikipedia.org/wiki/Public_Suffix_List https://en.wikipedia.org/wiki/Public_Suffix_List