tls: fixed a bug where wilcard matching for “*.foo.com” also matched domains of the form “a.b.foo.com”. This behavior can be temporarily reverted by setting runtime feature envoy.reloadable_features.fix_wildcard_matching to false.
envoy.reloadable_features.fix_wildcard_matching