Since bpo #23033, ssl.match_hostname() no longer supports partial wildcard matching, e.g. "www*.example.org". In case of a partial match, _dnsname_match() fails with a confusing/wrong error message:

>>> import ssl
>>> ssl._dnsname_match('www*.example.com', 'www1.example.com')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File ".../cpython/Lib/ssl.py", line 198, in _dnsname_match
    "wildcard can only be present in the leftmost segment: " + repr(dn))
ssl.SSLCertVerificationError: ("wildcard can only be present in the leftmost segment: 'www*.example.com'",)

The wildcard *is* in the leftmost segment. But it's not a full match but a partial match.

The error message applies to a SAN dNSName like "*.*.example.org" or "www.*.example.com",  however the function does not raise an error for multiple or non left-most wildcards:

# multiple wildcards return None
>>> ssl._dnsname_match('*.*.example.com', 'www.sub.example.com')
# single wildcard in another label returns False
>>> ssl._dnsname_match('www.*.example.com', 'www.sub.example.com')
False

New changeset aef1283ba428e33397d87cee3c54a5110861552d by Christian Heimes in branch 'master':
bpo-32819: Simplify and improve ssl.match_hostname (#5620)
https://github.com/python/cpython/commit/aef1283ba428e33397d87cee3c54a5110861552d

New changeset 46632f4d3c1f3aef875d2ada750a298ab0510992 by Christian Heimes (Miss Islington (bot)) in branch '3.7':
[3.7] bpo-32819: Simplify and improve ssl.match_hostname (GH-5620) (#5847)
https://github.com/python/cpython/commit/46632f4d3c1f3aef875d2ada750a298ab0510992

master and 3.7 are fixed.

Should I backport the issue to 2.7 and 3.6, too? It changes behavior slightly because it drops support for partial wildcards. RFC 6125 consider it an optional feature. AFAIK browsers don't match them either.

Can confirm, no browsers do partial (or multiple) wildcards and the CABF rules don't allow public CAs to issue them.

(Didn't mean to update status)

Don't worry, it happens automatically when somebody replies to a pending ticket w/o closing it explicitly.

I need to backport the patch manually.

I also fixed an issue for Brandon's backport, https://bitbucket.org/brandon/backports.ssl_match_hostname/issues/12/update-to-implementation-from-37