Warm tip: This article is reproduced from stackoverflow.com, please click
certificate java playframework spring-boot ssl

Gettig CertificateException: "No name matching localhost found" in Playframework java application

发布于 2020-04-18 09:32:11

I have 2 applications, one app is in Spring Boot and other is in Playframework. I am trying to consume REST endpoint of Spring Boot application in Playframework application. I am accessing the REST endpoint using the certificate I've got. In my play application I've disabled the host name verification, but still I am getting this error. Below you can find code and configuration:

AsyncHttpClient-2-1, fatal error: 46: General SSLEngine problem
java.security.cert.CertificateException: No name matching localhost found

Spring Boot Application Configuration

application.properties

server.port=8085
server.ssl.key-alias=demo
server.ssl.key-password=changeit
server.ssl.key-store-provider=SUN
server.ssl.key-store-type=JKS
server.ssl.key-store=server.jks

enter image description here

Playframework Application Configuration

application.conf

play.ws.ssl.loose.acceptAnyCertificate = false
play.ws.ssl.loose.disableHostnameVerification = true

play.ws.ssl {
  trustManager = {
    stores = [
      { type = "PEM", path = "public.crt" }
    ]
  }
}

play.ws.ssl.debug = {
    all = false
    ssl = true
    certpath = true
}

If I set play.ws.ssl.loose.acceptAnyCertificate = true then it is working. I want to keep it as false and then access the end point.

I feel issue is with my configuration, that's why added config only. If more information is required, I will add the code snippets too.

Questioner
kulsin
Viewed
71
Frischling 2020-02-04 20:11

Thats a keystore problem, your client is configured in a way that it checks the hostname used against metadata in the keystore. So you either have to set the "Subject" CN to "localhost", or add Subject Alternative Names with "localhost" in the hostname.

I like https://keystore-explorer.org/ tool for creating keystore best, adding the SAN is easy there. Java's keytool can do the same, though with the "-ext san=dns:www.example.com"