title: javax.net.ssl.SSLPeerUnverifiedException: Certificate for <sub.app.domain> doesn't match any of the subject alternative names: [*.app.domain]]
body: <p>I am using a custom private CA and want to communicate between two services, both using a custom certificate. However, I am getting an error that I don't understand</p>
  
  <p>So on both services, I have set up a truststore with the private CA and a separate keystore with the certificate it identifies itself as. Going to a simple /hello route in a browser shows that the connection is secure (i.e the issuer is known and the common name is valid). This is the same when I <code>curl -iv https://{address}</code>, it says that the handshake passed saying 'SSL certificate verify ok' and that the domain matched the wildcard name on the certificate. </p>
  
  <p>However, when I try to do a simple GET request from the separate service, which is set up in the exact same way, I get the error listed in the title. The problem is that it says the certificate for the service I'm trying to contact cannot match any of the subject alternative names in its certificate to the domain it is registered on. But that is just absolutely incorrect, the only difference is that it uses a wildcard. This works from a browser AND the curl command which debugs the handshake. It just doesn't from my Java/Spring Boot code on the separate microservice. </p>
  
  <p>Does Java work differently in a stricter way that means it doesn't like to contact servers with wildcard certificates?</p>
  
  <p>EDIT: Adding the line shown below fixes this, so it's failing at hostname verification in Java (but not on a browser or debugging using curl). This is insecure so it's not THE solution.</p>
  
  <pre><code>SSLContext sslContext = new SSLContextBuilder().loadTrustMaterial(truststore, null).build();
  HostnameVerifier hostnameVerifier = new NoopHostnameVerifier(); // I added this line, but it's advised against as it's insecure
  SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext, hostnameVerifier);
  </code></pre>