Cannot call HTTPS untrusted URL from java client

Question

I want to call an https url from java and it is not trusted, and also it has no domain name but ip (public or private). When I call a url which has a domain name with untrusted certificate, it works. But of an IP address it doesn't work. This is the error I got and the source code. Can you tell me what is the problem and a way to solve this.

Thank you!

Error:

java.io.IOException: HTTPS hostname wrong:  should be <xxx.xxx.xxx.xxx>

Source:

public static void main(String args[]){

        StringBuffer param = new StringBuffer();
        param.append("https://xxx.xxx.xxx.xxx/insert.php");
        param.append("?a=a");
        param.append("&b=c");
        param.append("&c=c");   
        System.setProperty("java.protocol.handler.pkgs","com.sun.net.ssl.internal.www.protocol");
        Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());

        try{
            URL url =new URL(param.toString());
            URLConnection con = url.openConnection();
            con.setAllowUserInteraction(true);
            con.getInputStream();
            BufferedReader in = new BufferedReader( new InputStreamReader(con.getInputStream()));
            String inputLine;
            StringBuffer result = new StringBuffer();

            while ((inputLine = in.readLine()) != null){
                result.append(inputLine);
                            }
            in.close();

            System.out.println("Result=" + result.toString());
        }catch(Exception ee){
            System.out.print(ee);
        }

}

Did you install the server's certificate into the cacerts file? — Renato, Jan 09 '12 at 05:19
this might help http://www.java-samples.com/showtutorial.php?tutorialid=211 — Umer Hayat, Jan 09 '12 at 05:49
I added a certificate and It 443. Thing is if use this code for a address with a domain name, it works. — sura2k, Jan 09 '12 at 06:32
You can add the answer to your own question, this could help other people. — Renato, Jan 09 '12 at 09:03
@Umer Hayat: disabling certificate verification altogether (as shown in the link you provide) will indeed make it work, but it will also make it insecure... — Bruno, Jan 09 '12 at 17:45
@sura2k, you shouldn't need to add the security provider manually. — Bruno, Jan 09 '12 at 17:45

score 1 · Accepted Answer · edited Oct 07 '21 at 06:01

Unlike some browsers, Oracle's Java implementation of the hostname verifier follows RFC 2818 (the HTTPS specification) strictly when IP addresses are used (as opposed to host names). In particular, there MUST be an IP entry in the Subject Alternative Name extension.

Cannot call HTTPS untrusted URL from java client

1 Answers1