title: Java SSLException: hostname in certificate didn't match in android application
body: <p>I am working on an android application that uses rest services and hits my website(having SSL) for data. Also I have some other domains on the same server.</p>
  
  <p>Now when I try to hit my website it is checking for other domains
  e.g.</p>
  
  <p><strong>My website :</strong> 'abc.xyz.com'</p>
  
  <p><strong>Other domain :</strong> '*.mno.com'</p>
  
  <p><strong>REST URL e.g.:</strong> <a href="https://abc.xyz.com/restapiservice/data/%7Bdataid%7D?restkey=%7Brest-api-key%7D" rel="nofollow">https://abc.xyz.com/restapiservice/data/{dataid}?restkey={rest-api-key}</a></p>
  
  <p><strong>Error:</strong> </p>
  
  <blockquote>
    <p>javax.net.ssl.SSLException: hostname in certificate didn't match:
     != &lt;<em>.mno.com> OR &lt;</em>.mno.com>
    OR </p>
  </blockquote>
  
  <p><strong>Code:</strong></p>
  
  <pre><code>try {
              // http client
              DefaultHttpClient httpClient;
              final HttpParams httpParams = new BasicHttpParams();
              HttpConnectionParams.setConnectionTimeout(httpParams, 30000);
              httpClient = new DefaultHttpClient(httpParams);
  
              //DefaultHttpClient httpClient = new DefaultHttpClient();
              HttpEntity httpEntity = null;
              HttpResponse httpResponse = null;
  
              // Checking http request method type
              if (method == POST) {
                  HttpPost httpPost = new HttpPost(url);
                  // adding post params
                  if (params != null) {
                      httpPost.setEntity(new UrlEncodedFormEntity(params));
                  }
  
                  httpResponse = httpClient.execute(httpPost);
  
              } else if (method == GET) {
                  // appending params to url
                  if (params != null) {
                      String paramString = URLEncodedUtils
                              .format(params, "utf-8");
                      url += String.format("?%s", paramString);
                  }
                  HttpGet httpGet = new HttpGet(url);
  
                  httpResponse = httpClient.execute(httpGet);
  
              }
              httpEntity = httpResponse.getEntity();
              response = EntityUtils.toString(httpEntity, HTTP.UTF_8);
  
          } catch (UnsupportedEncodingException e) {
              e.printStackTrace();
          } catch (ClientProtocolException e) {
              e.printStackTrace();
          } catch (IOException e) {
              e.printStackTrace();
          }
  </code></pre>
  
  <p><strong>I have tried solution:</strong></p>
  
  <pre><code>        try {
  
          HostnameVerifier hostnameVerifier = org.apache.http.conn.ssl.SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER;
  
          DefaultHttpClient client = new DefaultHttpClient();
  
          //Added my part
  
          final HttpParams httpParams = new BasicHttpParams();
          HttpConnectionParams.setConnectionTimeout(httpParams, 30000);
          client = new DefaultHttpClient(httpParams);
  
          //End my part
  
          SchemeRegistry registry = new SchemeRegistry();
          SSLSocketFactory socketFactory = SSLSocketFactory.getSocketFactory();
          socketFactory.setHostnameVerifier((X509HostnameVerifier) hostnameVerifier);
          registry.register(new Scheme("https", socketFactory, 443));
          SingleClientConnManager mgr = new SingleClientConnManager(client.getParams(), registry);
          DefaultHttpClient httpClient = new DefaultHttpClient(mgr, client.getParams());
  
          // Set verifier
          HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);
  
          HttpEntity httpEntity = null;
          HttpResponse httpResponse = null;
  
          // Checking http request method type
          if (method == POST) {
              HttpPost httpPost = new HttpPost(url);
              // adding post params
              if (params != null) {
                  httpPost.setEntity(new UrlEncodedFormEntity(params));
              }
  
              httpResponse = httpClient.execute(httpPost);
  
          } else if (method == GET) {
              // appending params to url
              if (params != null) {
                  String paramString = URLEncodedUtils
                          .format(params, "utf-8");
                  url += String.format("?%s", paramString);
              }
              HttpGet httpGet = new HttpGet(url);
  
              httpResponse = httpClient.execute(httpGet);
  
          }
          httpEntity = httpResponse.getEntity();
          response = EntityUtils.toString(httpEntity, HTTP.UTF_8);
  
      } catch (UnsupportedEncodingException e) {
          e.printStackTrace();
      } catch (ClientProtocolException e) {
          e.printStackTrace();
      } catch (IOException e) {
          e.printStackTrace();
      }
  </code></pre>
  
  <p>But I don't want to use it, as it might cause some security threats (I don't want to use "ALLOW_ALL_HOSTNAME_VERIFIER")</p>
  
  <p>Please suggest me some other alternative to this.</p>