title: SSL Certificate Verification : javax.net.ssl.SSLHandshakeException
body: <p>I am trying to call a HTTPS REST API through <code>Jersey Client</code>. And on the course of development i stumble upon following error :</p>
  <pre><code>Exception in thread &quot;main&quot; com.sun.jersey.api.client.ClientHandlerException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching mvn.signify.abc.com found
      at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:149)
      at com.sun.jersey.api.client.Client.handle(Client.java:648)
      at com.sun.jersey.api.client.WebResource.handle(WebResource.java:670)
      at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74)
      at com.sun.jersey.api.client.WebResource$Builder.get(WebResource.java:503)
      at com.lftechnology.sbworkbench.utility.utils.PingFederateUtility.main(PingFederateUtility.java:32)
  Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching mvn.signify.abc.com found
  </code></pre>
  <p>So I googled it out for a bit and found tons of solution for it , which actually works.</p>
  <ol>
  <li><a href="https://stackoverflow.com/questions/2145431/https-using-jersey-client">HTTPS using Jersey Client</a></li>
  <li><a href="https://gist.github.com/outbounder/1069465" rel="noreferrer">https://gist.github.com/outbounder/1069465</a></li>
  <li><a href="https://stackoverflow.com/questions/19540289/how-to-fix-the-java-security-cert-certificateexception-no-subject-alternative">How to fix the &quot;java.security.cert.CertificateException: No subject alternative names present&quot; error?</a></li>
  <li><a href="http://www.mkyong.com/webservices/jax-ws/java-security-cert-certificateexception-no-name-matching-localhost-found/" rel="noreferrer">http://www.mkyong.com/webservices/jax-ws/java-security-cert-certificateexception-no-name-matching-localhost-found/</a></li>
  <li><a href="http://java.globinch.com/enterprise-java/security/fix-java-security-certificate-exception-no-matching-localhost-found/" rel="noreferrer">http://java.globinch.com/enterprise-java/security/fix-java-security-certificate-exception-no-matching-localhost-found/</a></li>
  </ol>
  <p>They are in different domain but they have a common solution to work it out.</p>
  <h2>Scenario</h2>
  <p>I am currently using a self created self-signed certificate in development environment. And hence it is bound to show up the issue.</p>
  <h2>Question</h2>
  <p>The above mentioned solution focus on skipping / allowing all certificates to be verified.</p>
  <p>But when i move it to the production environment , then i have access to Valid Signed Certificate from trustworthy source.</p>
  <ol>
  <li>So are these solution any help when I move to production?</li>
  <li>Is it OK to skip SSL verification ?</li>
  <li>What are the other alternate way to achieve a common solution for
  both development and production environment?</li>
  </ol>
  <p>P.S</p>
  <p>The solution i used was ,</p>
  <pre><code>try
  {
      // Create a trust manager that does not validate certificate chains
      TrustManager[] trustAllCerts = new TrustManager[] {new X509TrustManager() {
          public java.security.cert.X509Certificate[] getAcceptedIssuers() {
              return null;
          }
          public void checkClientTrusted(X509Certificate[] certs, String authType) {
          }
          public void checkServerTrusted(X509Certificate[] certs, String authType) {
          }
      }
      };
  
      // Install the all-trusting trust manager
      SSLContext sc = SSLContext.getInstance(&quot;SSL&quot;);
      sc.init(null, trustAllCerts, new java.security.SecureRandom());
      HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
  
      // Create all-trusting host name verifier
      HostnameVerifier allHostsValid = new HostnameVerifier() {
          public boolean verify(String hostname, SSLSession session) {
              return true;
          }
      };
  
      // Install the all-trusting host verifier
      HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
  } catch (NoSuchAlgorithmException e) {
      e.printStackTrace();
  } catch (KeyManagementException e) {
      e.printStackTrace();
  }
  </code></pre>
  <p>which i then in-cooperate with <code>Jersey</code> to make it work. And it is working great.</p>
  <p>So , the <code>Question</code> again. <strong>Is this solution viable to be used in Production environment?</strong>
  However, you don’t want to modify the returning entities, it’s much better to fetch the entities in read-only mode. This will allows Hibernate to discard the associated detached state which is used by the dirty checking mechanism to detect entity state modifications. More, read-only entities are skipped during flushing.</p>