Validate wildcard certificates as specified in RFC 6125. In particular, `*.example.com` should match `foo.example.com` but NOT `bar.foo.example.com` as it previously did.
abs
nonstring