無主題備用DNS名稱匹配ex.ample.com發現

對於我的應用程序在運行ex.ample.com我從startssl如果/ StartCom以下證書：無主題備用DNS名稱匹配ex.ample.com發現

Certificate: 
    Data: 
     Version: 3 (0x2) 
     Serial Number: 163069 (0x27cfd) 
     Signature Algorithm: sha1WithRSAEncryption 
     Issuer: C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Class 1 Primary Intermediate Server CA 
     Validity 
      Not Before: Nov 27 21:26:01 2010 GMT 
      Not After : Nov 29 15:32:05 2011 GMT 
     Subject: description=303703-Sv1xMdnmzg6garMt, C=NL, O=Persona Not Validated, OU=StartCom Free Certificate Member, CN=ex.ample.com/[email protected] 
     Subject Public Key Info: 
      Public Key Algorithm: rsaEncryption 
      RSA Public Key: (2048 bit) 
       Modulus (2048 bit): 
        .... 
       Exponent: 65537 (0x10001) 
     X509v3 extensions: 
      X509v3 Basic Constraints: 
       CA:FALSE 
      X509v3 Key Usage: 
       Digital Signature, Key Encipherment, Key Agreement 
      X509v3 Extended Key Usage: 
       TLS Web Server Authentication 
      X509v3 Subject Key Identifier: 
       31:68:B2:7B:A2:7C:79:54:B7:3E:66:FD:12:04:18:FC:FB:9B:34:64 
      X509v3 Authority Key Identifier: 
       keyid:EB:42:34:D0:98:B0:AB:9F:F4:1B:6B:08:F7:CC:64:2E:EF:0E:2C:45 

      X509v3 Subject Alternative Name: 
       DNS:ex.ample.com, DNS:ample.com 
      X509v3 Certificate Policies: 
       Policy: 1.3.6.1.4.1.23223.1.2.2 
        CPS: http://www.startssl.com/policy.pdf 
        CPS: http://www.startssl.com/intermediate.pdf 
        User Notice: 
        Organization: StartCom Ltd. 
        Number: 1 
        Explicit Text: Limited Liability, see section *Legal Limitations* of the StartCom Certification Authority Policy available at http://www.startssl.com/policy.pdf 

      X509v3 CRL Distribution Points: 
       URI:http://www.startssl.com/crt1-crl.crl 
       URI:http://crl.startssl.com/crt1-crl.crl 

      Authority Information Access: 
       OCSP - URI:http://ocsp.startssl.com/sub/class1/server/ca 
       CA Issuers - URI:http://www.startssl.com/certs/sub.class1.server.ca.crt 

      X509v3 Issuer Alternative Name: 
       URI:http://www.startssl.com/ 
    Signature Algorithm: sha1WithRSAEncryption 
     .....

我已經正確安裝此證書。當我使用Firefox訪問應用程序時，它可以工作。當我使用Java的HttpURLConnection雖則從中檢索頁面，我得到以下錯誤：

Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching ex.ample.com found. 
    at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:208) 
    at sun.security.util.HostnameChecker.match(HostnameChecker.java:94) 
    at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:285) 
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:271) 
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1012) 
    ... 14 more

我不明白爲什麼會這樣。 ex.ample.com是證書中的通用名稱（CN），也列在SAN中。我在我的信任庫中導入了StarSLL的證書，所以這不是問題。

來源

2010-11-28 Bart van Heukelom

什麼是URL？順便說一下，CN不*包含有效的主機名，但是主題替代名稱可以。 – 2010-11-28 20:42:37

不知道你是否仍在尋找答案。可能不會！

這裏的問題是您的證書中的DNS條目與您在應用程序中提供的服務器/主機名稱不匹配。你的代碼有一個主機名驗證的地方。刪除該位代碼或更改您提供給證書中的DNS名稱的主機名。

來源

2017-03-15 17:24:08

無主題備用DNS名稱匹配ex.ample.com發現

回答

相關問題