When the subjectAltName extension contains a domain name system

label, the domain name MUST be stored in the dNSName (an IA5String).

The name MUST be in the "preferred name syntax", as specified by

Section 3.5 of [RFC1034] and as modified by Section 2.1 of

[RFC1123]. Note that while uppercase and lowercase letters are

allowed in domain names, no significance is attached to the case. In

addition, while the string " " is a legal domain name, subjectAltName

extensions with a dNSName of " " MUST NOT be used. Finally, the use

of the DNS representation for Internet mail addresses

(subscriber.example.com instead of subscriber@example.com) MUST NOT

be used; such identities are to be encoded as rfc822Name.

the semantics of subject alternative names that include

wildcard characters (e.g., as a placeholder for a set of names) are

not addressed by this specification. Applications with specific

requirements MAY use such names, but they must define the semantics.

DNS name restrictions are expressed as host.example.com. Any DNS

name that can be constructed by simply adding zero or more labels to

the left-hand side of the name satisfies the name constraint. For

example, www.host.example.com would satisfy the constraint but

host1.example.com would not.