handle wildcard DNSNames with IDNA.

fixes #2054

1 files changed, 14 insertions, 1 deletions

diff --git a/src/cryptography/hazmat/backends/openssl/x509.py b/src/cryptography/hazmat/backends/openssl/x509.py
index a03414c8..ce8b89cc 100644
--- a/src/cryptography/hazmat/backends/openssl/x509.py
+++ b/src/cryptography/hazmat/backends/openssl/x509.py
@@ -82,7 +82,20 @@ def _decode_general_names(backend, gns):
 def _decode_general_name(backend, gn):
     if gn.type == backend._lib.GEN_DNS:
         data = backend._ffi.buffer(gn.d.dNSName.data, gn.d.dNSName.length)[:]
-        return x509.DNSName(idna.decode(data))
+        if data.startswith(b"*."):
+            # This is a wildcard name. We need to split on period, remove the
+            # leading wildcard, IDNA decode, then re-add the wildcard
+            # Wildcard characters should always be left-most (RFC 2595
+            # section 2.4).
+            parts = data.split(b".")
+            parts.pop(0)
+            data = u"*." + idna.decode(b".".join(parts))
+        else:
+            # Not a wildcard, decode away. If the string has a * in it anywhere
+            # invalid this will raise an InvalidCodePoint
+            data = idna.decode(data)
+
+        return x509.DNSName(data)
     elif gn.type == backend._lib.GEN_URI:
         data = backend._ffi.buffer(
             gn.d.uniformResourceIdentifier.data,