pfSense

You can achive this behaviour by modifying the file /etc/inc/util.inc

The problem lies within the is_domain() method which checks if the entered domain is indeed a valid domain string. Search for this method inside /etc/inc/util.inc and replace this line

if (preg_match('/^(?:(?:[a-z_0-9]|[a-z_0-9][a-z_0-9\-]*[a-z_0-9])\.)*(?:[a-z_0-9]|[a-z_0-9][a-z_0-9\-]*[a-z_0-9\.])$/i', $domain))

with the following

if (preg_match('/^(?:(?:[a-z_0-9\*]|[a-z_0-9][a-z_0-9\-]*[a-z_0-9])\.)*(?:[a-z_0-9]|[a-z_0-9][a-z_0-9\-]*[a-z_0-9\.])$/i', $domain))

This will allow a wildcard (*) as the first character allowing you to define wildcard domains in the SAN fields.

I hope this will make it inside the public release at some point.

That change is unlikely to make it in unless it's in a separate function or a separate option to the function to activate the behavior. Allowing wildcards in that function unconditionally would allow them in other places where they are not functional (e.g. aliases, hostname fields for things like VPN peer addresses, etc).

It will be easy if you submit a pull request at https://github.com/pfsense/pfsense
Then the devs can easily review, comment and commit...

I've created the pull request @ https://github.com/pfsense/pfsense/pull/1713

I've now registered for the ICLA (Username: dachande) and just created a new pull request @ https://github.com/pfsense/pfsense/pull/1902