Question: why doesn't my wildcard matching work with OpenSSL?

[Paul Smith]

On Mon, 2019-06-10 at 14:23 -0400, Viktor Dukhovni wrote:
> > $ openssl s_client -connect admin0.domain:8004 \
> >      -CAfile ca.cert -verify_hostname admin0.domain
> > 
> > ---
> >      Verify return code: 62 (Hostname mismatch)
> 
> It seems that you've elided too much information.  Is the hostname
> really "admin0.domain", or is there some underlying domain name
> that you've obfuscated?

I tried not to elide anything other than a lot of keys and stuff. 
Maybe that info isn't output?

That is actually the hostname (I have this running in a Docker
container to get the hostname set up without a lot of hassle).

But maybe that's my confusion.  What "hostname" is OpenSSL looking at? 
I told it the name I wanted it to use for the verify on the command
line: "-verify_hostname admin0.domain", which matches the wildcard the
certificate provides.

That appears to be what the docs say; from verify(1ssl):

 -verify_hostname hostname
     Verify if the hostname matches DNS name in Subject Alternative Name
     or Common Name in the subject certificate.

I thought that's all it used: this value plus the wildcard in the
certificate.  Am I misunderstanding this?  Where else will openssl go
looking for hostnames to match?

Note that if I don't use wildcards but instead have a full hostname in
the certificate, then verify hostname does work.  It's only using a
wildcard that doesn't match the way I thought it would.

Thanks for the reply!