diff --git a/lib/openssl/ssl.rb b/lib/openssl/ssl.rb
index 85a91dee2..b02dee334 100644
--- a/lib/openssl/ssl.rb
+++ b/lib/openssl/ssl.rb
@@ -335,7 +335,7 @@ def verify_wildcard(domain_component, san_component) # :nodoc:
       parts = san_component.split("*", -1)
 
       return false if parts.size > 2
-      return san_component == domain_component if parts.size == 1
+      return san_component == domain_component if parts.size <= 1
 
       # RFC 6125, section 6.4.3, subitem 3.
       # The client SHOULD NOT attempt to match a presented identifier
diff --git a/test/openssl/test_ssl.rb b/test/openssl/test_ssl.rb
index fa220650b..78b45934a 100644
--- a/test/openssl/test_ssl.rb
+++ b/test/openssl/test_ssl.rb
@@ -898,6 +898,7 @@ def test_verify_certificate_identity
   def test_verify_hostname
     assert_equal(true,  OpenSSL::SSL.verify_hostname("www.example.com", "*.example.com"))
     assert_equal(false, OpenSSL::SSL.verify_hostname("www.subdomain.example.com", "*.example.com"))
+    assert_equal(false, OpenSSL::SSL.verify_hostname("www.example.com", ".example.com"))
   end
 
   def test_verify_wildcard