SSL peer failed hostname validation for name

[Brent Putman]

On 9/30/15 4:27 PM, Nickles, Brent wrote:
>
>  
>
> Has anyone else experienced this?
>

Yes it's a known issue for a couple of months now.  It's an Oracle and
OpenJDK bug. Discussed on the list in great detail here:

http://marc.info/?l=shibboleth-users&m=143756726417879&w=2


> Short of rolling java versions back, is there a fix?
>
>  
>

You can supply a system property to the JVM
-Djdk.tls.trustNameService=true  that should work (although its
original intention is for another reason).  That's a global change, so
if you have other apps in the same JVM, just be aware.

I just checked in a provisional fix to OpenSAML v2 to bypass the buggy
JDK behavior.  It will be in the next IdP patch release, but we haven't
decided exactly when that will be yet.  We're currently fully engaged
in trying to get the IdP 3.2.0 out.

Here's the issue tracking the v2 fix: 

https://issues.shibboleth.net/jira/browse/JOWS-47


 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150930/98bbe3bc/attachment.html>