I think this has long been an issue.
See
http://stackoverflow.com/questions/2115611/wildcard-ssl-on-sub-subdomain
http://stackoverflow.com/questions/3088022/is-it-possible-to-have-a-valid-sub-subdomain-with-a-wildcard-certificate
The certificate is issed for *.appspot.com not *.*.appspot.com
In fact searching a bit further, Google provide a workaround:
http://groups.google.com/group/google-appengine/browse_thread/thread/87b39f366191d743/ecea690ff0573fe5?lnk=gst&q=ssl+version+#ecea690ff0573fe5
> --
> You received this message because you are subscribed to the Google Groups "Google App Engine" group.
> To post to this group, send email to google-a...@googlegroups.com.
> To unsubscribe from this group, send email to google-appengi...@googlegroups.com.
> For more options, visit this group at http://groups.google.com/group/google-appengine?hl=en.
>
You can ask Apple for an emergency update. They don't like doing this
but it can be done. You might be able to get the new version out in
24 hours.
Get a new version into the hands of your customers ASAP, and recognize
that you should NEVER, EVER push out hard-to-update client software
pointing at a DNS name that you do not control. I sympathize with
your plight, but this was an *incredibly* poor decision.
Jeff
> --
> You received this message because you are subscribed to the Google Groups
> "Google App Engine" group.
> To view this discussion on the web visit
> https://groups.google.com/d/msg/google-appengine/-/ypMEF5DXk6IJ.