title: HostnameVerifier vs TrustManager?
body: <p>Under what circumstances would one use a <code>HostnameVerifier</code> over a <code>TrustManager</code> in Java? Is one recommended over the other? Looking at the Java docs (<a href="http://docs.oracle.com/javase/7/docs/api/javax/net/ssl/HostnameVerifier.html" rel="nofollow noreferrer">Interface HostnameVerifier</a> and <a href="http://docs.oracle.com/javase/7/docs/api/javax/net/ssl/TrustManager.html" rel="nofollow noreferrer">Interface TrustManager</a>), I can't tell when its best to use either (though the <code>TrustManager</code> seems more versatile).</p>
  
  <p>In the past, I have always used a custom <code>TrustManager</code>. However, I noticed <a href="https://stackoverflow.com/questions/23571736/heartbleed-exploit-in-java">Heartbleed exploit in java</a> uses both (but I don't think its correct).</p>
  
  <p><strong>EDIT</strong>: when using <code>HostnameVerifier</code>, are the other customary X509 checks performed, like path building and expiration and revocation (if configured)? I think I am essentially asking if <code>HostnameVerifier</code> supplements the other checks (rather than replacing them).</p>
  
  <p>For example, suppose a dev server is at <code>dev.example.com</code> and its signed by an internal CA. There's one DNS name in <code>dev.example.com</code>'s certificate, and its <code>dev.example.com</code>. Further, suppose I connect to it as <code>192.168.1.10</code>. Could I use a <code>HostnameVerifier</code> to allow both <code>dev.example.com</code> and <code>192.168.1.10</code>? In this scenario, is the additional name allowed <em>and</em> are the other customary X509 checks are performed?</p>