VA: ensure wildcard hostname is lowercased (#8643)

aarongable · web-flow · commit 99b017c470ad · 2026-02-25T10:08:12.000-05:00
diff --git a/va/caa.go b/va/caa.go
@@ -297,7 +297,7 @@ func (va *ValidationAuthorityImpl) checkCAARecords(
 	// If this is a wildcard name, remove the prefix
 	var wildcard bool
 	if strings.HasPrefix(hostname, `*.`) {
-		hostname = strings.TrimPrefix(ident.Value, `*.`)
+		hostname = strings.TrimPrefix(hostname, `*.`)
 		wildcard = true
 	}
 	caaSet, err := va.getCAA(ctx, hostname)

Original file line number	Diff line number	Diff line change
`@@ -297,7 +297,7 @@ func (va *ValidationAuthorityImpl) checkCAARecords(`
`297`	`297`	`// If this is a wildcard name, remove the prefix`
`298`	`298`	`var wildcard bool`
`299`	`299`	if strings.HasPrefix(hostname, `*.`) {
`300`		- hostname = strings.TrimPrefix(ident.Value, `*.`)
	`300`	+ hostname = strings.TrimPrefix(hostname, `*.`)
`301`	`301`	`wildcard = true`
`302`	`302`	`}`
`303`	`303`	`caaSet, err := va.getCAA(ctx, hostname)`