diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -67,7 +67,6 @@
 
 * Passwords are currently stored in plain text, please set permission accordingly and
   avoid using existing password.
-* Wildcard certificates are NOT supported at this moment.
 
 ### License
 
diff --git a/hprox.cabal b/hprox.cabal
--- a/hprox.cabal
+++ b/hprox.cabal
@@ -5,7 +5,7 @@
 -- see: https://github.com/sol/hpack
 
 name:           hprox
-version:        0.2.0
+version:        0.2.1
 synopsis:       a lightweight HTTP proxy server, and more
 description:    Please see the README on GitHub at <https://github.com/bjin/hprox#readme>
 category:       Web
diff --git a/src/Main.hs b/src/Main.hs
--- a/src/Main.hs
+++ b/src/Main.hs
@@ -7,6 +7,7 @@
 module Main where
 
 import qualified Data.ByteString.Char8       as BS8
+import           Data.List                   (isSuffixOf)
 import           Data.String                 (fromString)
 import           Network.HTTP.Client.TLS     (newTlsManager)
 import           Network.TLS                 as TLS
@@ -149,10 +150,17 @@
 
         onSNI Nothing = fail "SNI: unspecified"
         onSNI (Just host)
-          | host == primaryHost = return mempty
-          | otherwise           = case lookup host otherCerts of
-              Nothing   -> fail ("SNI: unknown hostname (" ++ show host ++ ")")
-              Just cert -> return (TLS.Credentials [cert])
+          | checkSNI host primaryHost = return mempty
+          | otherwise                 = lookupSNI host otherCerts
+
+        lookupSNI host [] = fail ("SNI: unknown hostname (" ++ show host ++ ")")
+        lookupSNI host ((p, cert) : cs)
+          | checkSNI host p = return (TLS.Credentials [cert])
+          | otherwise       = lookupSNI host cs
+
+        checkSNI host pattern = case pattern of
+            '*' : '.' : p -> ('.' : p) `isSuffixOf` host
+            p             -> host == p
 
         runner | isSSL     = runTLS tlsset
                | otherwise = runSettings