* match "*.com" or similar. This was a nonstandard check that we've since dropped. It is the CA's
   * responsibility to not hand out certificates that match so broadly.
   */
  @Test fun wildcardsDoesNotNeedTwoDots() {
    // openssl req -x509 -nodes -days 36500 -subj '/CN=*.com' -newkey rsa:512 -out cert.pem
    val session =
      session(
        """

           *
           * Also, it's nice that this approach should let us catch *only* ClassNotFoundException
           * instead of having to catch more broadly (potentially even including, say, a
           * StackOverflowError).
           */
          Class.forName("java.lang.invoke.VarHandle");
        } catch (ClassNotFoundException beforeJava9) {
          return null;