If you have a site with a wildcard certificate, and that site has an XSS attack reachable irrespective of Host header.

如果你的站点有一个万用证书，那么无论主机信息头部是什么样，这个站点都极有可能遭受跨站攻击。

youdao

To correct the problem, either purchase a certificate that lists both hostnames, or purchase a wildcard certificate for *.example.com.

为了改正错误，要不购买一个列出所有主机名的证书，要不购买一个带有通配符的证书*.example.com.

youdao