Add a regress test that matches a wildcard for a TLD specified as a FQDN.

This currently matches when we should reject it.

1 files changed, 9 insertions, 1 deletions

diff --git a/src/regress/lib/libtls/verify/verifytest.c b/src/regress/lib/libtls/verify/verifytest.c
index 9a5aa14076..72b8e4fd83 100644
--- a/src/regress/lib/libtls/verify/verifytest.c
+++ b/src/regress/lib/libtls/verify/verifytest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: verifytest.c,v 1.9 2026/05/30 16:55:09 jsing Exp $    */
+/*      $OpenBSD: verifytest.c,v 1.10 2026/05/30 17:04:48 jsing Exp $   */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -125,6 +125,14 @@ struct verify_test verify_tests[] = {
                 .want_match = 0,
         },
         {
+                /* CN wildcard without SANs - invalid CN wildcard. */
+                .common_name = "*.org.",
+                .common_name_len = -1,
+                .name = "openbsd.org.",
+                .want_return = 0,
+                .want_match = 0,
+        },
+        {
                 /* CN IPv4 without SANs - matching. */
                 .common_name = "1.2.3.4",
                 .common_name_len = -1,