Didn't the wildcard cert still need the alt-names specifying the host for the browser to accept the certificate as fully valid? I remember being annoyed by warnings until I added them a decade ago while playing around with a private CA at a previous job