Tonight I learned that Android, apparently, refuses to use one-label names as va

Tonight I learned that Android, apparently, refuses to use one-label names as valid for TLS: https://android.googlesource.com/platform/external/conscrypt/%2B/02cbb48fb78f11bd9b52b41d0ff4f40482f1a07f/repackaged/common/src/main/java/com/android/org/conscrypt/AddressUtils.java

Meaning that if you run a server with a private CA and a domain name like jenkins, metrics, grafana, you won't be able to connect to them by TLS. If you were using a search domain, like local or home, you can only use jenkins.local, jenkins.home and so on.

Comments in source code say that Android wants SNI hostname to be:

a FQDN that does not have a trailing dot.

And RFC 6066 indeed says exactly that. However, Android also considers names without a dot not FQDNs, according to their implementation. That's weird, because, according to Wikipedia definition:

a domain name that specifies its exact location in the tree hierarchy of the Domain Name System

Even com., or net. can be an FQDN, I think.

I researched a little bit further why Android could have implemented the dot requirement 🧐

On the same Wikipedia page:

A fully qualified domain name is conventionally written as a list of domain labels separated using the full stop "." character (dot or period)

And on RFC 3696:

Consequently, purported DNS names to be used in applications and to locate resources generally must contain at least one period (".") character

So, conventionally, FQDNs are expected to contain at least one dot. If you, like me, ever considered having TLS with one-label domains - consider this a warning. I wish you to have a good private TLD, while I go rebuild my private DNS zone 🫡