Use Lookup profile only in GetCertificate

This should allow wildcard names again.

Author: mholt

config.go

@@ -991,9 +991,7 @@ func (cfg *Config) generateCSR(privateKey crypto.PrivateKey, sans []string, useC
 
 	for _, name := range sans {
 		// identifiers should be converted to punycode before going into the CSR
-		// (convert IDNs to ASCII according to RFC 5280 section 7, but use profile
-		// recommended by RFC 5891 section 5)
-		normalizedName, err := idna.Lookup.ToASCII(name)
+		normalizedName, err := idna.ToASCII(name)
 		if err != nil {
 			return nil, fmt.Errorf("converting identifier '%s' to ASCII: %v", name, err)
 		}

crypto.go

@@ -240,8 +240,8 @@ func (cfg *Config) loadCertResourceAnyIssuer(ctx context.Context, certNamesKey s
 func (cfg *Config) loadCertResource(ctx context.Context, issuer Issuer, certNamesKey string) (CertificateResource, error) {
 	certRes := CertificateResource{issuerKey: issuer.IssuerKey()}
 
-	// for lookup/comparison, use profile recommended by RFC 5891 section 5
-	normalizedName, err := idna.Lookup.ToASCII(certNamesKey)
+	// don't use the Lookup profile because we might be loading a wildcard cert which is rejected by the Lookup profile
+	normalizedName, err := idna.ToASCII(certNamesKey)
 	if err != nil {
 		return CertificateResource{}, fmt.Errorf("converting '%s' to ASCII: %v", certNamesKey, err)
 	}

handshake.go

@@ -876,6 +876,12 @@ func (cfg *Config) getTLSALPNChallengeCert(clientHello *tls.ClientHelloInfo) (*t
 // If hello.ServerName is empty (i.e. client did not use SNI), then the
 // associated connection's local address is used to extract an IP address.
 func (cfg *Config) getNameFromClientHello(hello *tls.ClientHelloInfo) (string, error) {
+	// IDNs must be converted to punycode for use in TLS certificates (and SNI), but not
+	// all clients do that, so convert IDNs to ASCII according to RFC 5280 section 7
+	// using profile recommended by RFC 5891 section 5; this solves the "σςΣ" problem
+	// (see https://unicode.org/faq/idn.html#22) where not all normalizations are 1:1.
+	// The Lookup profile, for instance, rejects wildcard characters (*), but they
+	// should never be used in the ClientHello SNI anyway.
 	name, err := idna.Lookup.ToASCII(strings.TrimSpace(hello.ServerName))
 	if err != nil {
 		return "", err