SSL Connection to IP Number impossible?

Question

Hi all,
(this is a crosspost from the Networking Forum, it fits better here, I think http://forum.java.sun.com/thread.jspa?threadID=5256171&tstart=0 )
I am trying to open an ssl connection (https) to an URL containing the ip adress as numbers, like https://1.2.3.4 (this is not the real adress).
The certifcate I use is valid and contains the IP Number in the common name.
On opening the connection I always get an IOException: https hostname wrong: should be <1.2.3.4>
Turning on debugging with -Djavax.net.debug=all doesn't give any more hints.
With a URL like https://login.yahoo.com, it works. I'm using Java SE 1.5.0_11.
Now, I know the URL should give the IP address as a name, like https://site.domain.country, but I wonder if I must do it that way?
Isn't there a workaround / switch in order to use an ip number?
Is it to use an own HostnameVerifier as suggested in Thread SSLException: Name in certificate "host1" does not match host name "host2" (http://forum.java.sun.com/thread.jspa?threadID=5224956&tstart=60)
Thanks for any help!
Here is the stack trace:
java.io.IOException: HTTPS hostname wrong: should be <1.2.3.4>
     at sun.net.www.protocol.https.HttpsClient.checkURLSpoofing(HttpsClient.java:490)
     at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:415)
     at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:170)
     at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:133)
     at de.sema.diwi.ss.oraxml.XMLHttp.doPost(XMLHttp.java:231)
     at de.sema.diwi.ss.oraxml.XMLHttp.doPost(XMLHttp.java:90)
     at de.sema.diwi.ss.util.XMLReqRes.doXMLPost(XMLReqRes.java:741)
     at de.sema.diwi.ss.util.XMLReqRes.doXMLPost(XMLReqRes.java:613)
     at de.sema.diwi.ss.util.XMLReqRes.doHttpRequest(XMLReqRes.java:328)
     at de.sema.diwi.ss.control.SS_RMIImpl.XMLPost(SS_RMIImpl.java:315)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:585)
     at sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:294)
     at sun.rmi.transport.Transport$1.run(Transport.java:153)
     at java.security.AccessController.doPrivileged(Native Method)
     at sun.rmi.transport.Transport.serviceCall(Transport.java:149)
     at sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:466)
     at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:707)
     at java.lang.Thread.run(Thread.java:595)
doXMLPost: Null response from service.

Answer 1

Hi NephYliM,
the XMLHttp class is our own.
1st - the certificate already was in the truststore
2nd - a custom HostnameVerifier is enough, see attached code
Thanks for your post, but sorry - no dukes ;-)
roxon
Following HostnameVerifier does the trick, it's based on post http://forum.java.sun.com/thread.jspa?threadID=5224956&tstart=60 , but there is not even the need to set the hostname.
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLPeerUnverifiedException;
import javax.net.ssl.SSLSession;
import javax.security.auth.x500.X500Principal;
public class MyHostnameVerifier implements HostnameVerifier {
     public MyHostnameVerifier() {
          super();
      * Gets the CN from a certificate
     private String getCN(String DN) {
          String[] dnComponents = DN.split(",");
          // Find one that starts with CN=
          for (int i = 0; i <= dnComponents.length; i++) {
               if (dnComponents.startsWith("cn=")) {
                    return dnComponents[i].substring(3);
          return "";
     * Verify that a self defined host name is an acceptable match with the
     * server's authentication scheme.
     public boolean verify(String hostname, SSLSession session) {
          try {
               X500Principal peerPrincipal = (X500Principal) session
                         .getPeerPrincipal();
               String DN = peerPrincipal.getName("CANONICAL");
               // now parse the CN out of the effing DN
               // We should also get the subject alternative names
               // from the peer certificate
               String CN = getCN(DN);
               return CN.equals(hostname);
          } catch (SSLPeerUnverifiedException e) {
               return false;