On: Amazon S3 Path Deprecation Plan – The Rest of the ...

[mmastrac]

Isn't it technically valid to issue a cert with (star).domain.com, (star).(star).domain.com, (star).(star).(star).domain.com, etc...?

[koolba → mmastrac]

No you can only have a single wildcard per domain listed in a cert.

[deathanatos → koolba]

And only as the leftmost component, that is, (star).example.com is valid, foo.(star).example.com is not.

[judge2020 → mmastrac]

You can technically create them, but IIRC browsers don't trust them.

[oasisbob → judge2020]

And creating/signing them is a violation of the CAB Forum Baseline requirements.