cli: don't add wildcard SAN

[burgerdev]

The plain wildcard SAN * can't be used with the majority of TLS implementations, which makes it ineffective for use outside the cluster where standard implementations (in particular, browsers) are usually used. Inside the cluster, where more permissive TLS libraries may be in use, its presence does more harm than good, considering that workloads may impersonate each other. Thus, don't add a plain * as SAN anymore.

Fixes CON-222.

[linear-code]

CON-222

[github-actions]

Do the documentation changes need to be backported?

Changes to /docs/docs won't be visible until the next release.
If you are fixing something in the docs that should be immediately visible, the changes needs to be made to both /docs/docs and /docs/versioned_docs/version-X.Y, where X.Y is the version of the latest minor release.
This can be done in this same PR.

• Yes, this should be backported to the current version of the docs.
• No, the PR only contains docs changes relevant for future versions.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-09-01 15:46 UTC

[sespiros]

Thanks, I had this commit as part of some other forgotten branch with "improvements" somewhere.

A couple of more stale docs/tests:

• contrast/docs/docs/getting-started/deployment.md

  Line 563 in 5ba870c

  + "*",

• contrast/docs/docs/howto/workload-deployment/workload-communication.md

  Line 37 in 5ba870c

  By default, mesh certificates are issued with a wildcard DNS entry.

• contrast/internal/manifest/manifest_test.go

  Line 24 in 5ba870c

  SANs: []string{"example.com", "*"},

[burgerdev]

Addressed, thanks!