SSL peer failed hostname validation for name

[Takeshi NISHIMURA]

> FWIW, this bug is still present in Oracle's 1.8.0_60 release.

Yes.

Hopefully new version which will be released on 20th October may fix the problem.
8u65, 8u66
7u91
6u105

cf. https://bugs.openjdk.java.net/browse/JDK-8133196

I cannot find any patch or commit about the fix yet...

On 2015/10/01 6:05, Baron Fujimoto wrote:
> On Wed, Sep 30, 2015 at 08:27:49PM +0000, Nickles, Brent wrote:
>> Hello, recently java was upgraded on our servers and we are getting the following when trying to retrieve metadata with https:
>>
>> 02:09:09.005 - ERROR [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:273] - Error retrieving metadata from https://xxx.xxx.xxx/svn/ds/webauth/metadata/xxxxxx.xml
>> javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname validation for name: <ip address>
>>
>>
>> [~]{516}$ java -version
>> java version "1.7.0_85"
>> OpenJDK Runtime Environment (rhel-2.6.1.3.el6_7-x86_64 u85-b01) OpenJDK 64-Bit Server VM (build 24.85-b03, mixed mode)
>>
>>
>> Has anyone else experienced this?  Short of rolling java versions back, is there a fix?
>>
>> Thanks for your help.
>> Brent
>
> I believe this is the bug described in this thread:
>
> <http://shibboleth.1660669.n2.nabble.com/Shib-IdP-Metadata-Download-and-Java-1-7-0-85-td7617478.html>
>
> tl;dr: set java option "-Djdk.tls.trustNameService=true"
>
> FWIW, this bug is still present in Oracle's 1.8.0_60 release.
>
> -baron