From 675fd74282cd55958ad228fe38c51eea55f6418b Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Sat, 30 May 2026 17:04:48 +0000
Subject: Add a regress test that matches a wildcard for a TLD specified as a
 FQDN.

This currently matches when we should reject it.
---
 src/regress/lib/libtls/verify/verifytest.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/regress/lib/libtls/verify/verifytest.c b/src/regress/lib/libtls/verify/verifytest.c
index 9a5aa14076..72b8e4fd83 100644
--- a/src/regress/lib/libtls/verify/verifytest.c
+++ b/src/regress/lib/libtls/verify/verifytest.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: verifytest.c,v 1.9 2026/05/30 16:55:09 jsing Exp $	*/
+/*	$OpenBSD: verifytest.c,v 1.10 2026/05/30 17:04:48 jsing Exp $	*/
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -124,6 +124,14 @@ struct verify_test verify_tests[] = {
 		.want_return = 0,
 		.want_match = 0,
 	},
+	{
+		/* CN wildcard without SANs - invalid CN wildcard. */
+		.common_name = "*.org.",
+		.common_name_len = -1,
+		.name = "openbsd.org.",
+		.want_return = 0,
+		.want_match = 0,
+	},
 	{
 		/* CN IPv4 without SANs - matching. */
 		.common_name = "1.2.3.4",
-- 
cgit v1.2.3-55-g6feb