Error : java.security.cert.CertificateException: Illegal given domain name: abc_xyz.stg.myweb.com

Question

Hi team i found below exception when calling an api

https://abc_xyz.stg.myweb.com/api/AuthorizedUser?username=admin&password=admin

java.security.cert.CertificateException: Illegal given domain name

when getting response from server using Jersey. Everything is fine when i get response from postman.

Why it is illegal domain name, whether browser not refuse to open this.

If my domain name not contains underscore then this exception is not rising. Is this problem of underscore in domain name?

Possible duplicate of [How to fix the "java.security.cert.CertificateException: No subject alternative names present" error?](https://stackoverflow.com/questions/19540289/how-to-fix-the-java-security-cert-certificateexception-no-subject-alternative) — vinS, Dec 18 '17 at 09:35
No it is different question, In this scenario it is not connected with endpoint — Nitin Parashar, Dec 18 '17 at 11:44

score 9 · Accepted Answer · edited Oct 12 '20 at 06:05

9

In case anyone see this issue again. This issue is caused by an old jdk that thinks an underscore is invalid as the sub domain name, which in a later version has been removed from the jdk. So in short upgrade jdk version will solve this issue.

edited Oct 12 '20 at 06:05

homaxto

5,428
8
37
53

answered Jan 25 '18 at 14:11

jacob

106
2

what version of JDK you were using before? and what version did you update too? – Alex da Silva Jan 25 '18 at 21:53
thanks @jacob, it is resolve my issue when i see docs, it said java 1.8.25 above version resolve this issue. – Nitin Parashar Jan 30 '18 at 08:41
4

Very strange. Here I am, years later, using JDK 16, and I'm having this problem. I had to register and refer to the alternate name with '-'s instead of '_'s. – CryptoFool Mar 02 '22 at 01:47
Guys you saved my live...this issue is crazy.... – JDIBO Jun 03 '23 at 17:06

score 7 · Answer 2 · answered Jan 10 '19 at 16:14

7

In case someone see this issue again and don't want to change jdk version, it is possible to disable the SSL Host name verification (and it is not the good solution but sometimes it is not possible to avoid this..) :

    HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
        public boolean verify(String hostname, SSLSession session) {
            return true;
        }
    });

answered Jan 10 '19 at 16:14

Fabien MIFSUD

335
5
14

1

+1 but it could be insecure way. ref: [How to resolve Insecure HostnameVerifier](https://support.google.com/faqs/answer/7188426?hl=en) – geunho Sep 28 '22 at 04:44

score 0 · Answer 3 · answered Sep 29 '20 at 07:40

0

I had the same issue, and couldn't update jdk nor wanted disable ssl host name verification. Changing the underscore character in the name to a dash ('-' instead of '_') worked perfectly. Apparently dash and underscore are evaluated the same.

answered Sep 29 '20 at 07:40

Tigris

133
8

That's not true – Chad Mar 17 '21 at 15:44
I just ran into this same issue. I can confirm that simply replacing '_'s with '-'s in my URL did NOT work. I had to actually register the alternate DNS name to get things working. – CryptoFool Mar 02 '22 at 01:44

Error : java.security.cert.CertificateException: Illegal given domain name: abc_xyz.stg.myweb.com

3 Answers3

Linked