@Test public void subjectAltName() throws Exception {
        // $ cat ./cert.cnf
        // [req]
        // distinguished_name=distinguished_name
        // req_extensions=req_extensions
        // x509_extensions=x509_extensions
        // [distinguished_name]
        // [req_extensions]
        // [x509_extensions]
        // subjectAltName=DNS:bar.com,DNS:baz.com
        //
        // $ openssl req -x509 -nodes -days 36500 -subj '/CN=foo.com' -config ./cert.cnf \
        //     -newkey rsa:512 -out cert.pem
        SSLSession session = session(""
                + "-----BEGIN CERTIFICATE-----\n"
                + "MIIBPTCB6KADAgECAgkA7zoHaaqNGHQwDQYJKoZIhvcNAQEFBQAwEjEQMA4GA1UE\n"
                + "AxMHZm9vLmNvbTAgFw0xMDEyMjAxODM5MzZaGA8yMTEwMTEyNjE4MzkzNlowEjEQ\n"
                + "MA4GA1UEAxMHZm9vLmNvbTBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQC+gmoSxF+8\n"
                + "hbV+rgRQqHIJd50216OWQJbU3BvdlPbca779NYO4+UZWTFdBM8BdQqs3H4B5Agvp\n"
                + "y7HeSff1F7XRAgMBAAGjHzAdMBsGA1UdEQQUMBKCB2Jhci5jb22CB2Jhei5jb20w\n"
                + "DQYJKoZIhvcNAQEFBQADQQBXpZZPOY2Dy1lGG81JTr8L4or9jpKacD7n51eS8iqI\n"
                + "oTznPNuXHU5bFN0AAGX2ij47f/EahqTpo5RdS95P4sVm\n"
                + "-----END CERTIFICATE-----");
        X509Certificate[] certs = {};
        assertFalse(verifier.verify(certs, "foo.com", session));
        assertTrue(verifier.verify(certs, "bar.com", session));
        assertTrue(verifier.verify(certs, "baz.com", session));
        assertFalse(verifier.verify(certs, "a.foo.com", session));
        assertFalse(verifier.verify(certs, "quux.com", session));
    }
Earlier implementations of Android's hostname verifier required that
wildcard names wouldn't match "*.com" or similar. This was a nonstandard
check that we've since dropped. It is the CA's responsibility to not hand
out certificates that match so broadly.
common/src/test/java/org/conscrypt/HostnameVerifierTest.java