[NET-605] FTPSClient forces IP in SubjectAlternativeNames field for server certificate validation instead of hostname

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Resolved
• Affects Version/s: 3.5
• Component/s: FTP
• Assignee: Unassigned
• Reporter: Adam Lynam
• Created: 12/Dec/16 13:17
• Updated: 01/Mar/17 15:49
• Resolved: 01/Mar/17 15:49

Description

We have an FTP Server with a signed certificate, with both CN and SAN DNS entries set to the respective hostname of the machine.

When attempting to connect using FTPSClient, we get java.security.cert.CertificateException: No subject alternative names matching IP address x.x.x.x found. The FTPSClient appears to resolve the IP address and pass that through the SSLSocket where it eventually raises the exception.

While we initially encountered the error against our internal FTP server, we have confirmed the same issue against a public FTP server. ftps://demo:[e-mail].