Custom SSL Hostname Verifier - SSL Hostname Verification Failed

Question

Background:
I am using a java client deployed in weblogic which connects to a 3rd party url over HTTPS.
version: WebLogic server 10.3.0
Issue:
I am connecting to say www.abc.com and the site is presenting its certificate as **.ABC.com*. and I am getting Hostname verification failed.
I am using weblogic's default hotname verifier.
Setting hostname verification to false resolving this error, but I want to keep it for security.
Can anybody please share some best practices to write a custom HostnameVerifier to overcome this kind of problems?
Thanks in advance!

Answer 1

An example - this validates that a cert sent to a cluster member ( such as by OSB's internals ) will be validated when the cluster uses a a load balancer address ( defined in the cluster's http tab )
private final String QA_LB_NAME = "my_loadbalancer.net";
private final String QA_HOST1 = "my_serverhost1.net";
private final String QA_HOST2 = "my_serverhost2.net";
public boolean verify(String hostname, SSLSession session) {
try {
Certificate cert = session.getPeerCertificates()[0];
byte[] encoded = cert.getEncoded();
CertificateFactory cf = CertificateFactory.getInstance("X.509");
ByteArrayInputStream bais = new ByteArrayInputStream(encoded);
X509Certificate xcert = (X509Certificate)cf.generateCertificate(bais);
String cn = getCanonicalName(xcert.getSubjectDN().getName());
if (cn.equals(hostname))
return true;
// Allow a match if the load balancer cert is presented from one of its
// servers
if (cn.equals(QA_LB_NAME) &&
((hostname.equals(QA_HOST1)) || (hostname.equals(QA_HOST2))))
return true;
// all other certs fail
return false ;
You can do something similar with your wildcard example - allow the validation if the cn is "*.abc.com" and the hostname is "www.abc.com"
As far as best practices, I would suggest only have specific hard-coded validation entries for known certificates such as your wild card example. You want the default behavior ( of the hostname matching the CN name ) plus your particular case - and nothing else