# istio_se-wildcard-tls-host.yaml
apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 54540
releaseNotes:
  - |
    **Added** support for wildcard hosts in ServiceEntries with DYNAMIC_DNS resolution
    for TLS hosts. TLS `protocol` implies the connection will be routed based on the
    request's SNI (from the TLS handshake) without terminating the TLS connection to
    inspect the Host header for routing. The implementation relies on an alpha API
    and has significant security implications (i.e. SNI spoofing). Therefore, this
    feature is disabled by default and can be enabled by setting the feature flag
    `ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS` to true. Please consider the use of
    this feature carefully and only with trusted clients.