[BUG] robust wildcard certificate naming

What happened?

Wildcard and non-wildcard certs for the same base (e.g. hosts.example.com) could collide in the filesystem/UI.

For *.hosts.example.com, the base was incorrectly treated as example.com, so the cert didn’t match the intended scope. Multiple wildcard scopes (e.g. *.hosts.example.com and *.api.example.com) could be merged into one *.example.com cert instead of one cert per scope.

How to reproduce?

Dedicated wildcard cert name: Store wildcard certs under _wildcard_.<base> (e.g. _wildcard_.hosts.example.com). _wildcard_ is not a valid hostname, so there is no overlap with real server names.

Correct base for subdomain wildcards: For *.hosts.example.com, use base hosts.example.com (full cleaned domain), not example.com.

One cert per wildcard scope: For different scopes (e.g. *.hosts.example.com and *.api.example.com), issue separate certs (e.g. _wildcard_.hosts.example.com and _wildcard_.api.example.com) instead of merging into a single *.example.com cert.

Configuration file(s) (yaml or .env)

Relevant log output

BunkerWeb version

1.6.9

What integration are you using?

Linux

Linux distribution (if applicable)

debian 13.3

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct