pub fn zone_covers(zone: &str, host: &str) -> boolExpand description
Whether a certificate for zone — covering zone and *.zone — is the
right certificate to present for host.
The one-label rule, stated once: the apex itself, or exactly one label
under it. agent.claudes.pds.did.bot is not covered by a certificate
for pds.did.bot, which is the whole reason a deployment needs a
certificate per zone rather than one at the root.