HTTPS hostname wrong

Albert

unread,

Dec 10, 2003, 1:01:14 PM12/10/03

to

I got the following error while I tested a HTTPS connection to a
hostname 1company.mydomain.com.

java.io.IOException: HTTPS hostname wrong: should be
<1company.mydomain.com>

The hostname in the HTTPS request is exactly as same as in the
certificate. And I can open up the hostname using an IE browser
without any problem. I know how to skip the hostname verification, but
I don't feel comfortable to do that.

Any thoughts? I notice the hostname starting with a digit. It is rare.
Can that cause any problem in Java?

Thanks
Albert

VK

unread,

Dec 10, 2003, 4:46:09 PM12/10/03

to

are you using full path (including the protocol part)?
https://1company.mydomain.com

Albert

unread,

Dec 11, 2003, 1:04:06 PM12/11/03

to

Yes, it has full path with protocol part. And here is the stack trace:

java.io.IOException: HTTPS hostname wrong: should be
<1company.mydomain.com>

at sun.net.www.protocol.https.HttpsClient.b(DashoA6275)
at sun.net.www.protocol.https.HttpsClient.afterConnect(DashoA6275)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(DashoA6275)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:574)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(DashoA6275)
at java.net.URL.openStream(URL.java:960)

Thanks
Albert

"VK" <school...@yahoo.com> wrote in message news:<3fd796b0$0$17067$9b62...@news.freenet.de>...

Tor Iver Wilhelmsen

unread,

Dec 11, 2003, 4:21:21 PM12/11/03

to

alber...@yahoo.com (Albert) writes:

> java.io.IOException: HTTPS hostname wrong: should be
> <1company.mydomain.com>

Examine the SSL server certificate to see what it says there.

JK

unread,

Dec 12, 2003, 4:17:59 AM12/12/03

to

Also check for uppercase letters. Even though your browser doesn't care,
the names are case sensitive and must match in the URL and the
certificate's subjectDN. I have had a similar problem with an e-mail
certificate.

Regards
JK

Albert

unread,

Dec 14, 2003, 11:45:37 PM12/14/03

to

Do you mean subject CN? I use the "keytool -printcert" command to show
the detail of the cert. The hostname is displayed as the value of CN.
There is no uppercase letter in the hostname.

The hostname starts with a digit. It is rare. Could that cause problem
for JDK1.4.1_02?

And where can I download the source code for
sun.net.www.protocol.https.HttpsClint? I don't find it in
java.sun.com. I want to use a visual debugger to debug the error.

Thanks
Albert

JK <nob...@nowhere.org> wrote in message news:<brc0td$unm$1...@nathan.rz.tu-harburg.de>...

JK

unread,

Dec 16, 2003, 4:40:08 AM12/16/03

to

Yes, the CN must match, e.g.

CN=www.mysite.org

when you want to connect via

https://www.mysite.org

The source code of Sun's SSL classes is not open, I think due to the US
export regulations.

Regards
JK.

Albert wrote:
> Do you mean subject CN? I use the "keytool -printcert" command to show
> the detail of the cert. The hostname is displayed as the value of CN.
> There is no uppercase letter in the hostname.
>
> The hostname starts with a digit. It is rare. Could that cause problem
> for JDK1.4.1_02?
>
> And where can I download the source code for
> sun.net.www.protocol.https.HttpsClint? I don't find it in
> java.sun.com. I want to use a visual debugger to debug the error.
>
> Thanks
> Albert
>

Albert

unread,

Dec 16, 2003, 12:48:23 PM12/16/03

to

Yes, the hostname in the CN does match the hostname in the request. I
am stuck in this issue. Anyone knows how to esclate the issue to SUN?

Thanks
Albert

JK <nob...@nowhere.org> wrote in message news:<brmjmh$3c0$1...@nathan.rz.tu-harburg.de>...

Hans Granqvist

unread,

Dec 16, 2003, 7:02:35 PM12/16/03

to

alber...@yahoo.com (Albert) wrote in message news:<d3e7c208.03121...@posting.google.com>...

There is a known error with this IOException: the host names are
mixed so that the exception always(?) prints the CN of the cert you're
trying to use, not the one you're connecting to, so you will seldom
be able to get a good error message.

The error is probably elsewhere. How did you create this server
certificate? Does it have unusual/bad OIDs?

-Hans

Albert

unread,

Dec 24, 2003, 5:14:29 PM12/24/03

to

I don't think that is the case for my problem. The server certificate
is created by our Partner. I am sure the hostname in the CN is the
same one as in the HTTPS request.

-Albert