0

We have a process use HttpClient to make https connection with different URLs. Our JDK version is 1.7. We found some URLs, if we use default JSSE SIN extension flag, which is turn on, we got the following exception:

javax.net.ssl.SSLProtocolException: handshake alert:  unrecognized_name

If we set -Djsse.enableSNIExtension=false, some other URLs throw this exception:

javax.net.ssl.SSLException: Received fatal alert: unrecognized_name

Does anybody have idea about this?

wittich
  • 2,079
  • 2
  • 27
  • 50
Shawn
  • 1
  • 1
  • 1
  • Please add examples of such URLs (for public sites only). – Steffen Ullrich Mar 04 '15 at 06:50
  • 1
    possible duplicate of [SSL handshake alert: unrecognized\_name error since upgrade to Java 1.7.0](http://stackoverflow.com/questions/7615645/ssl-handshake-alert-unrecognized-name-error-since-upgrade-to-java-1-7-0) – Steffen Ullrich Mar 04 '15 at 06:53
  • The strange thing is if with SNI extension flag set to false, the server extension name should not be count, but still got unrecognized_name error, any idea about it? – Shawn Mar 06 '15 at 16:39
  • If the have only certificates set for SNI hosts and no default certificate this might still happen. – Steffen Ullrich Mar 06 '15 at 16:42

1 Answers1

0

The SNI extension will add the server_name(hostname) in the client hello message at the SSL handshake stage.

It may be needed by a server that serves requests for different hostnames or virtual hosts. It is used to resolve the Certificate for the hostname the client intend to communicate with. The server may be configured with a default certificate if the host name is not added or not found. The default certificate may be a multisigned certificate for all the hosts it serves.

The first warning you get may be a server responding with a default certificate but that also warns that the hostname is not recognized. The server probably does not recognize the hostname simply because it is not included in the configuration. Instead of ignoring the warning and use the default certificate, Java seems to throw an exception.

In the other case where you disabled SNI, you do not include the hostname anymore and the request is sent to a server that does not have a default certificate. It will respond with a fatal error because it cannot resolve any certificate for you.

Unknown
  • 136
  • 1
  • 5