CODEWITHSUNDEEP
sslssl-certificate
user6447305
user6447305

Reputation:

Certificate hostname verification in java - subject alternative names

I am using a certificate with subject alternative names in the "Subject" field instead of x509 extensions.

A java client that I use still fails connecting to https url complaining that hostname in certificate didn't match. My understanding is as long as the hostname is listed in Subject Alt Names it should work.

Here is the format of the Subject field in the certificate

C=US,ST=.......CN=x.yz.com/[email protected]/subjectAltName=DNS.1=x2.y.com,DNS.2=x3.y.com

Is it necessary to define SAN as X509 extensions

Upvotes: 1

Views: 2082

Answers (1)

Simone Carletti
Simone Carletti

Reputation: 176382

The subjectAltName is expected to be an X509v3 extension of the certificate, not a part of the Subject field. Therefore, if you listed the SAN names into the Subject, your certificate is invalid.

Here's an example of a certificate that defines an SAN. This answer contains the list of allowed fields for a subject.

Upvotes: 2

Related Questions