@Test
    public void subjectAltNameWithToplevelWildcard() throws Exception {
        // Default OkHostnameVerifier instance should allow SANs which
        // have wildcards for top-level domains.  The strict instance should not.
        //
        // Certificate generated using:-
        //     openssl req -x509 -nodes -days 36500 -subj "/CN=Google Inc" \
        //         -addext "subjectAltName=DNS:*.com" -newkey rsa:512
        SSLSession session = session(""
                + "-----BEGIN CERTIFICATE-----\n"
                + "MIIBlTCCAT+gAwIBAgIUe1RB6C61ZW/SEQpKiywSEJOEOUMwDQYJKoZIhvcNAQEL\n"
                + "BQAwFTETMBEGA1UEAwwKR29vZ2xlIEluYzAgFw0xOTExMjExMjE1NTBaGA8yMTE5\n"
                + "MTAyODEyMTU1MFowFTETMBEGA1UEAwwKR29vZ2xlIEluYzBcMA0GCSqGSIb3DQEB\n"
                + "AQUAA0sAMEgCQQCu24jT8hktpvnmcde4dqC6e7G5F4cNNLUFnTi3Ay9BzPH1r7sN\n"
                + "v2lHTIQLKSlvjxa48mpeRBlOjDQigv7c+rfRAgMBAAGjZTBjMB0GA1UdDgQWBBQd\n"
                + "myvYKfluxb0+kNEJoh1ZER2wUTAfBgNVHSMEGDAWgBQdmyvYKfluxb0+kNEJoh1Z\n"
                + "ER2wUTAPBgNVHRMBAf8EBTADAQH/MBAGA1UdEQQJMAeCBSouY29tMA0GCSqGSIb3\n"
                + "DQEBCwUAA0EAK710g2hQpXSmpbOQH4dHG61fkVDtM/kR/4/R61vDDqVkgOuyHqXl\n"
                + "GUZFKHMeOZ8peQLT8b+5ik6pIO7Vu2pF6w==\n"
                + "-----END CERTIFICATE-----\n");
        X509Certificate[] certs = {};
        assertTrue(OkHostnameVerifier.INSTANCE.verify(certs, "google.com", session));
        assertFalse(OkHostnameVerifier.strictInstance().verify(certs, "google.com", session));
    }
Earlier implementations of Android's hostname verifier required that
wildcard names wouldn't match "*.com" or similar. This was a nonstandard
check that we've since dropped. It is the CA's responsibility to not hand
out certificates that match so broadly.
common/src/test/java/org/conscrypt/HostnameVerifierTest.java