HTTPS hostname wrong: should be . What causes this?

Question

I am getting this 'HTTPS hostname wrong:' error when trying to connect to a server using https. My url looks something like this

https://sub.domain.com/tamnode/webapps/app/servlet.

I connect using the following code

    // Create a URLConnection object for a URL
    URL url = new URL(requestedURL);
    HttpURLConnection.setFollowRedirects(false);

    // connect
    connection = (HttpURLConnection) url.openConnection();
    connection.setDoOutput(true);
    connection.setRequestProperty("User-Agent", USER_AGENT); //$NON-NLS-1$

    OutputStreamWriter wr = new OutputStreamWriter(connection
            .getOutputStream());

but then get an error

IOException: HTTPS hostname wrong:  should be <sub.domain.com>. 
    at sun.net.www.protocol.https.HttpsClient.checkURLSpoofing
    ....

This is code which has worked in the past but no longer. There have been some changes to the system architecture but I need to get more data before approaching those responsible.

What can cause this error? Can I turn off the URLSpoofing check?

score 23 · Accepted Answer · answered Nov 26 '09 at 07:24

23

It looks like the SSL certificate for domain.com has been given to sub.domain.com. Or, more likely, what was domain.com has been renamed to sub.domain.com without updating the SSL certificate.

answered Nov 26 '09 at 07:24

cletus

616,129
168
910
942

score 13 · Answer 2 · edited May 23 '17 at 11:46

cletus is right about the probable cause.

There is a way to turn off the spoof checking, too.

You can create an object that implements HostnameVerifier that returns true under more circumstances than 'usual'.

You would replace the default HostnameVerifier by calling setHostnameVerifier on the connection object in the code in the question.

This answer was 'inspired by': http://www.java-samples.com/showtutorial.php?tutorialid=211

I found that link with this query: http://www.google.com/search?q=https+hostname+wrong+should+be

One more note: think twice before you do this. You will create an exploitable weakness in the security between your client and server components.

The 2 oracle links are broken – Stuart Siegler May 16 '12 at 12:39 — Stuart Siegler, May 16 '12 at 12:39

score 9 · Answer 3 · answered May 31 '12 at 11:40

I got this exception - java.io.IOException: HTTPS hostname wrong: should be <localhost>.

My solution is I changed my self-signed certificate and make the CN=localhost.

OR

Add your certificate domain-name cn=<domain-name> to your host file probably located at c:/windows/system32/drivers/etc/...

score 8 · Answer 4 · edited Nov 22 '18 at 12:50

8

The following code resolved my problem

static {
    //for localhost testing only
    javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier(
            new javax.net.ssl.HostnameVerifier() {

        @Override
        public boolean verify(String hostname,
                javax.net.ssl.SSLSession sslSession) {
            if (hostname.equals("your_domain")) {
                return true;
            }
            return false;
        }
    });
}

edited Nov 22 '18 at 12:50

svarog

9,477
4
61
77

answered Apr 20 '15 at 10:00

Jure Males

97
1
3

You should not write code 'for testing only'. Inevitably it leaks into production and compromises the security of the system. – user207421 Feb 25 '18 at 22:25
See also https://stackoverflow.com/questions/37724901/disable-sslhandshakeexception-for-a-single-connection. I needed to support this for a library that needed to make outbound connections to localhost where cert used did not match the localhost name. So the code used a HostnameVerifier for a specific call, and only applied code when a flag -DdevelopmentMode=true is exists. – PatS Jan 05 '19 at 01:01

score 0 · Answer 5 · answered May 24 '19 at 03:17

Java by default verifies that the certificate CN (Common Name) is the same as hostname in the URL. If the CN in the certificate is not the same as the host name, your web service client fails with the following exception: java.io.IOException: HTTPS hostname wrong: should be hostname as in the certificates.

score 0 · Answer 6 · answered Nov 05 '19 at 11:26

0

This is just an alternative of 'svarog' post

static {

    HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> hostname.equals("domain name"));
}

answered Nov 05 '19 at 11:26

jegadeesh

109
2
8

score -1 · Answer 7 · edited Apr 12 '19 at 23:06

-1

Use host name (dns name) as Alias name.

Ex:

keytool -import -alias <google.com> -file certificate_one.cer -keystore cacerts

edited Apr 12 '19 at 23:06

jaykumarark

2,359
6
35
53

answered Apr 12 '19 at 21:13

user11353764

1

HTTPS hostname wrong: should be . What causes this?

7 Answers7

This is just an alternative of 'svarog' post

Linked

Related