title: Tomcat Websocket disable hostname verification
body: <p>I'm trying to disable the hostname verification for tomcat websocket implementation, but I didn't find any example.</p>
  
  <p>I've been able to disable the cert validation:</p>
  
  <pre><code>WebSocketContainer container = ContainerProvider.getWebSocketContainer();
  ClientEndpointConfig config = ClientEndpointConfig.Builder.create().build();
  TrustStrategy acceptingTrustStrategy = (X509Certificate[] chain, String authType) -&gt; true;
  SSLContext sslContext = org.apache.http.ssl.SSLContexts.custom()
                  .loadTrustMaterial(null, acceptingTrustStrategy)
                  .build();
  
  config.getUserProperties().put("org.apache.tomcat.websocket.SSL_CONTEXT", sslContext);
  </code></pre>
  
  <p>The official documentation says:</p>
  
  <p><em>For secure server end points, host name verification is enabled by default. To bypass this verification (not recommended), it is necessary to provide a custom SSLContext via the org.apache.tomcat.websocket.SSL_CONTEXT user property. The custom SSLContext must be configured with a custom TrustManager that extends javax.net.ssl.X509ExtendedTrustManager. The desired verification (or lack of verification) can then be controlled by appropriate implementations of the individual abstract methods.</em></p>
  
  <p><a href="https://tomcat.apache.org/tomcat-8.5-doc/web-socket-howto.html" rel="nofollow noreferrer">https://tomcat.apache.org/tomcat-8.5-doc/web-socket-howto.html</a></p>
  
  <p>But as long as I understand X509ExtendedTrustManager is used for certificate validation, not the hostname verification.</p>
  
  <p>Can anyone help me with it?</p>