title: Java HTTPS request: hostname in certificate doesn't match
body: <p>I'm trying to make a HTTPS request from a Java 8 client (using Apache HttpClient 4.3) to a public server (that I don't own). I've never normally had any problems with the requests, but the target server appears to have made some changes and requests started to fail.  </p>
  
  <p>Initially, the error was an <code>ValidatorException: PKIX Path Building Failed</code> but I fixed this by adding the servers certificate to my Java trust store. The error I'm getting now is <code>hostname in certificate didn't match: &lt;target.server.com&gt; != &lt;*.something.else.com&gt; OR &lt;something.else.com&gt;</code>.  </p>
  
  <p>The <code>something.else.com</code> host is some sort of hosting site etc. anyway I'm satisfied there's nothing suspicious going on. I pulled the certificate for <code>target.server.com</code> by running the following command:  </p>
  
  <pre><code>openssl s_client -connect target.server.com:443 -showcerts
  </code></pre>
  
  <p>I don't see any reference to <code>target.server.com</code> in the certificate info, only for <code>something.else.com</code>. I don't have any problems visiting <code>target.server.com</code> in a web browser (Chrome) and there are no complaints about the SSL certificate. I added the servers certificate to my trust store using this command:</p>
  
  <pre><code>sudo keytool -import -file /tmp/target.cer -keystore /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts -alias targetserv
  </code></pre>
  
  <p>Is there some way I can fix this without a Java code change e.g. adding something to the certificate import command etc. and if not, how else can I get these requests working again.  </p>
  
  <hr>
  
  <p>Here's my HTTP request code (using HttpClient 4.3):</p>
  
  <pre><code>CloseableHttpClient httpClient = HttpClients.custom().setUserAgent(HTTP_USER_AGENT).build();
  HttpGet request = new HttpGet(url);
  HttpResponse response = httpClient.execute(request);
  </code></pre>
  
  <p>...throws <code>java.io.IOException: hostname in certificate didn't match</code> </p>
  
  <p>Also, this is the actual target server that I'm trying to reach: <a href="https://www.isi.gov.ie" rel="nofollow noreferrer">https://www.isi.gov.ie</a> </p>
  
  <hr>
  
  <p>I've tried using HttpClient v4.5 and I still get the same error as with 4.3. I've tried making a request using Java's built HTTP request classes, and the request succeeds (a 302 is returned): </p>
  
  <pre><code>URL obj = new URL("https://www.isi.gov.ie");
  HttpURLConnection con = (HttpURLConnection) obj.openConnection();
  
  con.setRequestMethod("GET");
  con.setRequestProperty("User-Agent", USER_AGENT);
  
  int responseCode = con.getResponseCode();
  System.out.println("\nSending 'GET' request to URL : " + url);
  System.out.println("Response Code : " + responseCode);
  
  BufferedReader in = new BufferedReader(
          new InputStreamReader(con.getInputStream()));
  
  String inputLine;
  StringBuffer response = new StringBuffer();
  
  while ((inputLine = in.readLine()) != null) {
      response.append(inputLine);
  }
  in.close();
  
  //print result
  System.out.println(response.toString());
  </code></pre>
  
  <p>Is there any way I can fix these issues with HttpClient?</p>
  
  <hr>
  
  <p>It turns out that elsewhere in my application I had been disabling SNI using the Java system property <code>jsse.enableSNIExtension</code> and I had forgotten about it. The reason I was doing that is because it was the only fix I could find that would prevent ALL HTTP requests using HttpClient from failing with the error:</p>
  
  <blockquote>
    <p>sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target</p>
  </blockquote>
  
  <p>How can I re-enable SNI without getting these errors?<br>
  I'm using the following version of Java:</p>
  
  <pre><code>openjdk version "1.8.0_212"
  OpenJDK Runtime Environment (build 1.8.0_212-8u212-b03-0ubuntu1.18.04.1-b03)
  OpenJDK 64-Bit Server VM (build 25.212-b03, mixed mode)
  </code></pre>