Annoyingly, TLS wildcards have very a different meaning to DNS wildcards.

DNS wildcards only work when * is the leftmost label of a domain name, so

    *.example.com is a wildcard
    foo.*.example.com is not a wildcard
    *bar.example.com is not a wildcard

A DNS wildcard matches any non-zero number of labels, so

    *.example.com
    foo.example.com matches
    foo.bar.example.com matches
    example.com does not match

RFC 4592 describes DNS wildcards.

Unlike the DNS, the * in a TLS certificate can only match one label, so

    *.example.com
    foo.example.com matches
    foo.bar.example.com does NOT match
    example.com does not match

RFC 2818 also allows the * to appear within a domain name, not just as the leftmost label, and wildcards work even when they are part of a label. One of its examples says

    f*.com
    foo.com matches
    bar.com does not match

But nowadays sub-label wildcards like this are not supported.