SSL peer failed hostname validation for name

[Baron Fujimoto]

On Wed, Sep 30, 2015 at 08:27:49PM +0000, Nickles, Brent wrote:
>Hello, recently java was upgraded on our servers and we are getting the following when trying to retrieve metadata with https:
>
>02:09:09.005 - ERROR [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:273] - Error retrieving metadata from https://xxx.xxx.xxx/svn/ds/webauth/metadata/xxxxxx.xml
>javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname validation for name: <ip address>
>
>
>[~]{516}$ java -version
>java version "1.7.0_85"
>OpenJDK Runtime Environment (rhel-2.6.1.3.el6_7-x86_64 u85-b01) OpenJDK 64-Bit Server VM (build 24.85-b03, mixed mode)
>
>
>Has anyone else experienced this?  Short of rolling java versions back, is there a fix?
>
>Thanks for your help.
>Brent

I believe this is the bug described in this thread:

<http://shibboleth.1660669.n2.nabble.com/Shib-IdP-Metadata-Download-and-Java-1-7-0-85-td7617478.html>

tl;dr: set java option "-Djdk.tls.trustNameService=true"

FWIW, this bug is still present in Oracle's 1.8.0_60 release.

-baron
-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum