According to
|
const size_t pos = server_name.find('.'); |
the wildcard is allowed before the first dot, it means that www.example.com will be matched by an SNI domain *.example.com, but not by *.com or *. Maybe this fact should be stressed in the documentation https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/listener/listener.proto#listener-filterchainmatch .
According to
envoy/source/common/ssl/context_manager_impl.cc
Line 116 in a22159a
the wildcard is allowed before the first dot, it means that
www.example.comwill be matched by an SNI domain*.example.com, but not by*.comor*. Maybe this fact should be stressed in the documentation https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/listener/listener.proto#listener-filterchainmatch .