SSLException: Name in certificate "host1" does not match host name "host2"

Question

Hi all,
I am using a hosted WebDAV/Subversion service to store my files. The provider has connected my domain name to the service, so now I can access the service through my domain name :-)
However, the provider cannot assign a static dedicated IP for the server which provides my content, hence he cannot set an SSL certificate for my domain name. Any time I access the service I am getting an SSL warning telling me that the domain name does not match that on the certificate... So far had no problem with that. The Web browser, the Windows Explorer, and the Subversion client allow me to accept the connection.
Now I need to set up some automatic build software (Maven) and it appears that the JRE has a problem with these name mismatches -- it just throws an exception and does not allow me to accept the connection :-( In order to ensure that this is a JRE problem, I have tried to connect to the service with a Java-based WebDAV client (DAVExplorer) -- same thing -- here is the message thrown by DAVExplorer:
javax.net.ssl.SSLException: Name in certificate "his.domain.name" does not match host name "my.domain.name"
Is there some configuration file, system property or switch that I can use to make the JRE ignore the domain name mismatch thing?
Please help,
Adrian.

Answer 1

Here is a quick example I put together. Most of the code was autogenerated by Eclipse "Generate Delegate Methods" on the urlConn field of the class. This is just an example; I haven't given it much thought; it probably opens up other security holes and I take no responsibility for it.
In my example, I have an SSL server with the name "dawntreader" in the certificate, but my URL is https://192.168.10.7/ which triggers the name mismatch. I have not actually tested it with maven, but looking at these docs (http://maven.apache.org/guides/mini/guide-repository-ssl.html) I think that you should be able to add the following to the MAVEN_OPTS environment variable: -Djava.protocol.handler.pkgs=MyHttpsUrlConnection and make sure the MyHttpsUrlConnection.class file is on the classpath
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.MalformedURLException;
import java.net.ProtocolException;
import java.net.URL;
import java.security.Permission;
import java.security.Principal;
import java.security.cert.Certificate;
import java.util.List;
import java.util.Map;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLPeerUnverifiedException;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSocketFactory;
import javax.security.auth.x500.X500Principal;
public class MyHttpsURLConnection extends HttpsURLConnection
    static class MyHostnameVerifier implements HostnameVerifier
        private static final String EXPECTED_HOSTNAME = "dawntreader";
        private String getCN(String DN)
            String [] dnComponents = DN.split(",");
            // Find one that starts with CN=
            for (String component : dnComponents)
                if (component.startsWith("cn="))
                    return component.substring(3);
            return "";
        @Override
        public boolean verify(String hostname, SSLSession session)
            try
                X500Principal peerPrincipal = (X500Principal) session.getPeerPrincipal();
                String DN = peerPrincipal.getName("CANONICAL");
                // now parse the CN out of the effing DN
                // We should also get the subject alternative names
                // from the peer certificate
                String CN = getCN(DN);
                return CN.equals(EXPECTED_HOSTNAME);
            } catch (SSLPeerUnverifiedException e)
                return false;
    private final HttpsURLConnection urlConn;
    public MyHttpsURLConnection(URL url) throws IOException
        super(url);
        urlConn = (HttpsURLConnection) url.openConnection();
        urlConn.setHostnameVerifier(new MyHostnameVerifier());
    public void addRequestProperty(String key, String value)
        this.urlConn.addRequestProperty(key, value);
    public void connect() throws IOException
        this.urlConn.connect();
    public void disconnect()
        this.urlConn.disconnect();
    public boolean equals(Object obj)
        return this.urlConn.equals(obj);
    public boolean getAllowUserInteraction()
        return this.urlConn.getAllowUserInteraction();
    public String getCipherSuite()
        return this.urlConn.getCipherSuite();
    public int getConnectTimeout()
        return this.urlConn.getConnectTimeout();
    public Object getContent() throws IOException
        return this.urlConn.getContent();
    public Object getContent(Class[] classes) throws IOException
        return this.urlConn.getContent(classes);
    public String getContentEncoding()
        return this.urlConn.getContentEncoding();
    public int getContentLength()
        return this.urlConn.getContentLength();
    public String getContentType()
        return this.urlConn.getContentType();
    public long getDate()
        return this.urlConn.getDate();
    public boolean getDefaultUseCaches()
        return this.urlConn.getDefaultUseCaches();
    public boolean getDoInput()
        return this.urlConn.getDoInput();
    public boolean getDoOutput()
        return this.urlConn.getDoOutput();
    public InputStream getErrorStream()
        return this.urlConn.getErrorStream();
    public long getExpiration()
        return this.urlConn.getExpiration();
    public String getHeaderField(int n)
        return this.urlConn.getHeaderField(n);
    public String getHeaderField(String name)
        return this.urlConn.getHeaderField(name);
    public long getHeaderFieldDate(String name, long Default)
        return this.urlConn.getHeaderFieldDate(name, Default);
    public int getHeaderFieldInt(String name, int Default)
        return this.urlConn.getHeaderFieldInt(name, Default);
    public String getHeaderFieldKey(int n)
        return this.urlConn.getHeaderFieldKey(n);
    public Map<String, List<String>> getHeaderFields()
        return this.urlConn.getHeaderFields();
    public HostnameVerifier getHostnameVerifier()
        return this.urlConn.getHostnameVerifier();
    public long getIfModifiedSince()
        return this.urlConn.getIfModifiedSince();
    public InputStream getInputStream() throws IOException
        return this.urlConn.getInputStream();
    public boolean getInstanceFollowRedirects()
        return this.urlConn.getInstanceFollowRedirects();
    public long getLastModified()
        return this.urlConn.getLastModified();
    public Certificate[] getLocalCertificates()
        return this.urlConn.getLocalCertificates();
    public Principal getLocalPrincipal()
        return this.urlConn.getLocalPrincipal();
    public OutputStream getOutputStream() throws IOException
        return this.urlConn.getOutputStream();
    public Principal getPeerPrincipal() throws SSLPeerUnverifiedException
        return this.urlConn.getPeerPrincipal();
    public Permission getPermission() throws IOException
        return this.urlConn.getPermission();
    public int getReadTimeout()
        return this.urlConn.getReadTimeout();
    public String getRequestMethod()
        return this.urlConn.getRequestMethod();
    public Map<String, List<String>> getRequestProperties()
        return this.urlConn.getRequestProperties();
    public String getRequestProperty(String key)
        return this.urlConn.getRequestProperty(key);
    public int getResponseCode() throws IOException
        return this.urlConn.getResponseCode();
    public String getResponseMessage() throws IOException
        return this.urlConn.getResponseMessage();
    public Certificate[] getServerCertificates() throws SSLPeerUnverifiedException
        return this.urlConn.getServerCertificates();
    public SSLSocketFactory getSSLSocketFactory()
        return this.urlConn.getSSLSocketFactory();
    public URL getURL()
        return this.urlConn.getURL();
    public boolean getUseCaches()
        return this.urlConn.getUseCaches();
    public int hashCode()
        return this.urlConn.hashCode();
    public void setAllowUserInteraction(boolean allowuserinteraction)
        this.urlConn.setAllowUserInteraction(allowuserinteraction);
    public void setChunkedStreamingMode(int chunklen)
        this.urlConn.setChunkedStreamingMode(chunklen);
    public void setConnectTimeout(int timeout)
        this.urlConn.setConnectTimeout(timeout);
    public void setDefaultUseCaches(boolean defaultusecaches)
        this.urlConn.setDefaultUseCaches(defaultusecaches);
    public void setDoInput(boolean doinput)
        this.urlConn.setDoInput(doinput);
    public void setDoOutput(boolean dooutput)
        this.urlConn.setDoOutput(dooutput);
    public void setFixedLengthStreamingMode(int contentLength)
        this.urlConn.setFixedLengthStreamingMode(contentLength);
    public void setHostnameVerifier(HostnameVerifier v)
        this.urlConn.setHostnameVerifier(v);
    public void setIfModifiedSince(long ifmodifiedsince)
        this.urlConn.setIfModifiedSince(ifmodifiedsince);
    public void setInstanceFollowRedirects(boolean followRedirects)
        this.urlConn.setInstanceFollowRedirects(followRedirects);
    public void setReadTimeout(int timeout)
        this.urlConn.setReadTimeout(timeout);
    public void setRequestMethod(String method) throws ProtocolException
        this.urlConn.setRequestMethod(method);
    public void setRequestProperty(String key, String value)
        this.urlConn.setRequestProperty(key, value);
    public void setSSLSocketFactory(SSLSocketFactory sf)
        this.urlConn.setSSLSocketFactory(sf);
    public void setUseCaches(boolean usecaches)
        this.urlConn.setUseCaches(usecaches);
    public String toString()
        return this.urlConn.toString();
    public boolean usingProxy()
        return this.urlConn.usingProxy();
    public static void main(String[] args) throws MalformedURLException, IOException
        MyHttpsURLConnection urlConn = new MyHttpsURLConnection(new URL(
                "https://192.168.10.7/"));
        urlConn.connect();
        InputStream is = urlConn.getInputStream();
        int nread = 0;
        byte[] buf = new byte[8192];
        while ((nread = is.read(buf)) != -1)
            System.out.write(buf, 0, nread);
}