Description:

1. This issue is not a duplicate of Bug in logic detecting overlapping cert SANs #6321.
2. The cause of this issue is mistakenly treating all absolute domain names as wildcard domain names for comparison.
3. Use 'strings.HasSuffix' for comparison is reckless, because the wildcard applies only to one level of the domain name.

Repro steps:

1. Add a listener for foo.example.com and pdf.foo.example.com.
   ※ Use *.example.com and pdf.foo.example.com should also trigger the issue.
2. Use cert-manager to issue certs for them (note that a wildcard certificate should not be used)
3. Look in the logs to see a warning about overlapping SANs

Sample Gateway Listeners

listeners:
  - name: foo
    hostname: foo.example.com
    protocol: HTTPS
    port: 443
    tls:
      mode: Terminate
      certificateRefs:
        - name: foo-tls
  - name: foo-pdf
    hostname: pdf.foo.example.com
    protocol: HTTPS
    port: 443
    tls:
      mode: Terminate
      certificateRefs:
        - name: foo-pdf-tls

Environment:
Envoy Gateway v1.5.3

Logs:

Message:  The certificate SAN pdf.foo.example.com overlaps with the certificate SAN foo.example.com in listener foo. ALPN will default to HTTP/1.1 to prevent HTTP/2 connection coalescing, unless explicitly configured via ClientTrafficPolicy
Reason: OverlappingCertificates
Type: OverlappingTLSConfig