Currently, the addressed that are created for Knative services have form:

<kservice.name>.<kservice.ns>.apps.example.net

To be able to work with cluster wildcard certificate they should be created as:

<kservice.name>-<kservice.ns>.apps.example.net

The certificate is issued for:

*.apps.example.net

Wildcard certificates validate only on the same "dot" level, sub-levels are not supported by any browser.