@Bigou @evan
Some applications (e.g., #Mobilizon ) use frameworks that by default mark wildcard certs as not secure.

And maybe there are more, and you will waste hours until you find out it's not your code.

@mobilizon