code: private static boolean matchDns(String hostname, String tlsDnsPattern) throws SSLException {
      boolean hostIsIp = Utils.isIPv4(hostname) || Utils.isIPv6(hostname);
      StringTokenizer hostnameSt = new StringTokenizer(hostname.toLowerCase(Locale.ROOT), ".");
      StringTokenizer templateSt = new StringTokenizer(tlsDnsPattern.toLowerCase(Locale.ROOT), ".");
      if (hostnameSt.countTokens() != templateSt.countTokens()) {
        return false;
      }
  
      try {
        while (hostnameSt.hasMoreTokens()) {
          if (!matchWildCards(hostIsIp, hostnameSt.nextToken(), templateSt.nextToken())) {
            return false;
          }
        }
      } catch (SSLException exception) {
        throw new SSLException(
            normalizedHostMsg(hostname) + " doesn't correspond to certificate CN \"" + tlsDnsPattern
                + "\" : wildcards not possible for IPs");
      }
      return true;
    }
docs: DNS verification : Matching is performed using the matching rules specified by [RFC2459].  If
  more than one identity of a given type is present in the certificate (e.g., more than one
  dNSName name, a match in any one of the set is considered acceptable.) Names may contain the
  wildcard character * which is considered to match any single domain name component or component
  fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not
  bar.com.
  
  @param hostname      hostname
  @param tlsDnsPattern DNS pattern (may contain wildcard)
  @return true if matching