title: How come Apache HttpClient 4.4 rejects www.googleapis.com as a valid host name?
body: <p>I've recently switched to HttpClient 4.4 from 4.3 and I get the <code>SSLPeerUnverifiedException</code> saying:</p>
  <pre><code>Host name 'www.googleapis.com' does not match the certificate subject provided by the peer (CN=*.googleapis.com, O=Google Inc, L=Mountain View, ST=California, C=US)
  </code></pre>
  <p>The problem comes from the fact than HttpClient now uses the <a href="https://publicsuffix.org/" rel="nofollow noreferrer">publicsuffix.org</a> list for validation (see source code for <a href="http://svn.apache.org/repos/asf/httpcomponents/httpclient/trunk/httpclient/src/main/java/org/apache/http/conn/ssl/SSLConnectionSocketFactory.java" rel="nofollow noreferrer">SSLConnectionSocketFactory.java</a>).</p>
  <p>One way around this problem is to turn off the host name verification:</p>
  <pre><code>CloseableHttpClient httpClient = HttpClients.custom().
     setSSLHostnameVerifier(new NoopHostnameVerifier()).build();
  </code></pre>
  <p><strong>...but I'm trying to understand why the wildcard is not matched by the client and why it's considered as too broad</strong> (<a href="http://mail-archives.apache.org/mod_mbox/hc-httpclient-users/201502.mbox/%3C1423217019.4240.13.camel@apache.org%3E" rel="nofollow noreferrer">reference</a>).</p>
  <p>The <a href="https://www.rfc-editor.org/rfc/rfc2818#section-3.1" rel="nofollow noreferrer">RFC2818 spec</a> says:</p>
  <blockquote>
  <p>Names may contain the wildcard<br />
  character <code>*</code> which is considered to match any single domain name<br />
  component or component fragment. E.g., *.a.com matches foo.a.com but<br />
  not bar.foo.a.com. f*.com matches foo.com but not bar.com.</p>
  </blockquote>
  <p>Does this mean that HttpClient 4.4 doesn't honor the spec?</p>