diff --git a/backend/src/services/certificate-authority/certificate-authority-validators.ts b/backend/src/services/certificate-authority/certificate-authority-validators.ts
index 3a1be7cdf..3fa7e8d5e 100644
--- a/backend/src/services/certificate-authority/certificate-authority-validators.ts
+++ b/backend/src/services/certificate-authority/certificate-authority-validators.ts
@@ -16,7 +16,7 @@ export const validateAltNameField = z
   .refine(
     (name) => {
       return (
-        isFQDN(name, { allow_wildcard: true }) ||
+        isFQDN(name, { allow_wildcard: true, require_tld: false }) ||
         z.string().url().safeParse(name).success ||
         z.string().email().safeParse(name).success ||
         isValidIp(name)
@@ -45,7 +45,7 @@ export const validateAltNamesField = z
       // Split and validate each alt name
       return data.split(", ").every((name) => {
         return (
-          isFQDN(name, { allow_wildcard: true }) ||
+          isFQDN(name, { allow_wildcard: true, require_tld: false }) ||
           z.string().url().safeParse(name).success ||
           z.string().email().safeParse(name).success ||
           isValidIp(name)
diff --git a/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts b/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
index 086737d85..eace4e47a 100644
--- a/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
+++ b/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
@@ -160,6 +160,10 @@ export const InternalCertificateAuthorityFns = ({
           return { type: "email", value: altName };
         }
 
+        if (isFQDN(altName, { allow_wildcard: true, require_tld: false })) {
+          return { type: "dns", value: altName };
+        }
+
         if (z.string().url().safeParse(altName).success) {
           return { type: "url", value: altName };
         }
@@ -168,10 +172,6 @@ export const InternalCertificateAuthorityFns = ({
           return { type: "ip", value: altName };
         }
 
-        if (isFQDN(altName, { allow_wildcard: true })) {
-          return { type: "dns", value: altName };
-        }
-
         throw new BadRequestError({ message: `Invalid SAN entry: ${altName}` });
       });
 
@@ -434,6 +434,10 @@ export const InternalCertificateAuthorityFns = ({
           return { type: "email", value: altName };
         }
 
+        if (isFQDN(altName, { allow_wildcard: true, require_tld: false })) {
+          return { type: "dns", value: altName };
+        }
+
         if (z.string().url().safeParse(altName).success) {
           return { type: "url", value: altName };
         }
@@ -442,10 +446,6 @@ export const InternalCertificateAuthorityFns = ({
           return { type: "ip", value: altName };
         }
 
-        if (isFQDN(altName, { allow_wildcard: true })) {
-          return { type: "dns", value: altName };
-        }
-
         throw new BadRequestError({ message: `Invalid SAN entry: ${altName}` });
       });