From d10434974ad760b5239a917bed5cc7dc908551b7 Mon Sep 17 00:00:00 2001
From: Seth Schoen <schoen@eff.org>
Date: Sun, 12 Aug 2012 18:32:16 -0700
Subject: [PATCH] check wildcards in Observatory

---
 server-ca/chocolate.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server-ca/chocolate.py b/server-ca/chocolate.py
index 216980188..d220c2af1 100755
--- a/server-ca/chocolate.py
+++ b/server-ca/chocolate.py
@@ -273,6 +273,10 @@ class session(object):
                 if urllib2.urlopen("https://observatory.eff.org/check_name?domain_name=%s" % san).read().strip() != "False":
                     self.die(r, r.CannotIssueThatName, uri="https://ca.example.com/failures/observatory?%s" % san)
                     return
+                wildcard_variant = "*." + san.partition(".")[2]
+                if urllib2.urlopen("https://observatory.eff.org/check_name?domain_name=%s" % wildcard_variant).read().strip() != "False":
+                    self.die(r, r.CannotIssueThatName, uri="https://ca.example.com/failures/observatory?%s" % san)
+                    return
             except urllib2.HTTPError:
                 # Currently, don't consider it fatal if the Observatory blacklist
                 # service is inaccessible.