java.security.cert.CertificateException: Hostname '[wintest.johnshopkins.edu]' does not match the hostname in the server's certificate

[Etan Weintraub]

Thanks Nate. I've asked the Active Directory guys to update their certs with the SAN.

-Etan E. Weintraub
Sr. Systems Engineer
Directory Architecture
IT at Johns Hopkins
Johns Hopkins at Mt. Washington
5801 Smith Ave.
Suite 3110B
Baltimore, MD 21209
Phone: 410-735-7945
E-mail: eweintra at jhmi.edu<mailto:eweintra at jhmi.edu>

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: Thursday, June 06, 2013 11:40 AM
To: Shib Users
Subject: Re: java.security.cert.CertificateException: Hostname '[wintest.johnshopkins.edu]' does not match the hostname in the server's certificate

Etan,

http://shibboleth.net/community/advisories/secadv_20120227.txt

Ignoring the mismatch is not as good a solution as getting a valid certificate issued with subjectAltNames and I'm not sure it's supported.  Details on how matching is performed:

http://www.ldaptive.org/docs/guide/connections

Thanks,
Nate.

On Jun 6, 2013, at 15:02 , Etan Weintraub wrote:


Hi all-
I need some help. This currently works in our test and production environments, but I'm trying to set up our new test environment (going to IdP v2.4.0) and I can't get this piece to work or remember how I got it to work on the old systems. We use Active Directory for our backend LDAP servers that we access in the attribute-resolver.xml. We have a shared server name of "wintest.johnshopkins.edu", that is essentially a DNS round robin for the servers. Each individual server has its own certificate with its own hostname on it (i.e. wintestserver1.wintest.adtest.jhu.edu). Whenever I start Tomcat, I get an error in the idp-process.log that contains the string "java.security.cert.CertificateException: Hostname '[wintest.johnshopkins.edu]' does not match the hostname in the server's certificate" (there is a bunch more to the error as far as java errors, but this is I believe the key part).

Anyone know how to ignore the hostname mismatch for LDAPS connections in attribute-resolver.xml?

-Etan E. Weintraub
Sr. Systems Engineer
Directory Architecture
IT at Johns Hopkins
Johns Hopkins at Mt. Washington
5801 Smith Ave.
Suite 3110B
Baltimore, MD 21209
Phone: 410-735-7945
E-mail: eweintra at jhmi.edu<mailto:eweintra at jhmi.edu>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130606/3cd11254/attachment-0001.html