[HTTPCLIENT-1792] Improve the error message when hostname verification fails

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 4.4.1, 4.5.2
• Fix Version/s: 4.5.3, 5.0 Alpha2
• Component/s: HttpClient (classic)
• Assignee: Unassigned
• Reporter: Jens Borgland
• Created: 05/Dec/16 15:21
• Updated: 12/Jan/17 10:15
• Resolved: 12/Jan/17 10:15

Description

When hostname verification fails org.apache.http.conn.ssl.SSLConnectionSocketFactory will throw a SSLPeerUnverifiedException with a message like this:

Host name 'FOO' does not match the certificate subject provided by the peer (CN=BAR)

Expected:
Including the subject alternative names, rather than the CN, in the message would be a lot more helpful when troubleshooting (and probably more correct since the use of CN matching is deprecated through RFC 2818).