javax.net.ssl.SSLHandshakeException：java.security.cert.CertificateException：没有与 ZA12A3079E14CED46E69BA52B8A90B21 匹配的主题备用名称

Question

我有一个调用外部 api 的 java 应用程序，该应用程序托管在https://10.20.30.40:1234/test这样的地址上

这有一个带有 CN 的域基础证书，例如 *.myappdomain.au

我们已经在我们的 linux 服务器上完成了证书的注册。 我什至尝试使用以下代码加载证书，但它没有用，我们得到同样的错误

private static SSLSocketFactory createSSLSocketFactory(String certificatePath) throws IOException, CertificateException, KeyStoreException, NoSuchAlgorithmException, KeyManagementException {
        File crtFile = new File(certificatePath);
        
        Certificate certificate = CertificateFactory.getInstance("X.509").generateCertificate(new FileInputStream(crtFile));

        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        keyStore.load(null, null);
        keyStore.setCertificateEntry("server", certificate);

        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(keyStore);

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustManagerFactory.getTrustManagers(), null);

        return sslContext.getSocketFactory();
    }

我尝试过的一件事是在主机中添加条目，如 10.20.30.40 myappdomain.au，然后使用 url，如https://myappdomain.au:1234/test/myurl

然后应用程序工作

知道我还需要做什么

Answer 1

好吧，如果 API 托管在 IP 地址上，则 SSL 证书必须将 ZA12A3079E14CEDB1A22Z 证书定义为 528A替代名称。 但是，这不适用于Let's Encrypt 之类的服务。

我猜这个问题的主要原因是您试图通过 IP 地址而不是其 FQDN 访问 API。 Changing the URL of the API to the appropriate DNS name for the IP address in your source code should yield in everything working, as long as the DNS name resolves to something related to the domain the wildcard certificate was issued for (eg api.myappdomain.au ）。

Answer 2

尝试在连接之前运行此代码：

public static void trustAllCerts() {
    TrustManager[] trustAllCerts = new TrustManager[]{
            new X509TrustManager() {
                public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                    return null;
                }
                public void checkClientTrusted(
                    java.security.cert.X509Certificate[] certs, String authType) {
                }
                public void checkServerTrusted(
                    java.security.cert.X509Certificate[] certs, String authType) {
                }
            }
        };
    
    try {
        SSLContext sc = SSLContext.getInstance("SSL");
        sc.init(null, trustAllCerts, new java.security.SecureRandom());
        HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
    } catch (Exception e) {
            
        e.printStackTrace();

    }
}