SSL peer failed hostname validation for name

[Takeshi NISHIMURA]

Confirmed on 8u65.

Regards,
Takeshi

On 2015/10/01 20:05, Takeshi NISHIMURA wrote:
>> FWIW, this bug is still present in Oracle's 1.8.0_60 release.
>
> Yes.
>
> Hopefully new version which will be released on 20th October may fix the problem.
> 8u65, 8u66
> 7u91
> 6u105
>
> cf. https://bugs.openjdk.java.net/browse/JDK-8133196
>
> I cannot find any patch or commit about the fix yet...
>
> On 2015/10/01 6:05, Baron Fujimoto wrote:
>> On Wed, Sep 30, 2015 at 08:27:49PM +0000, Nickles, Brent wrote:
>>> Hello, recently java was upgraded on our servers and we are getting the following when trying to retrieve metadata with https:
>>>
>>> 02:09:09.005 - ERROR [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:273] - Error retrieving metadata from https://xxx.xxx.xxx/svn/ds/webauth/metadata/xxxxxx.xml
>>> javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname validation for name: <ip address>
>>>
>>>
>>> [~]{516}$ java -version
>>> java version "1.7.0_85"
>>> OpenJDK Runtime Environment (rhel-2.6.1.3.el6_7-x86_64 u85-b01) OpenJDK 64-Bit Server VM (build 24.85-b03, mixed mode)
>>>
>>>
>>> Has anyone else experienced this?  Short of rolling java versions back, is there a fix?
>>>
>>> Thanks for your help.
>>> Brent
>>
>> I believe this is the bug described in this thread:
>>
>> <http://shibboleth.1660669.n2.nabble.com/Shib-IdP-Metadata-Download-and-Java-1-7-0-85-td7617478.html>
>>
>> tl;dr: set java option "-Djdk.tls.trustNameService=true"
>>
>> FWIW, this bug is still present in Oracle's 1.8.0_60 release.
>>
>> -baron