java - SSLSocket ignores domain mismatch -

i reading ssl socket host doesn't match certificate (eg. host = "localhost"). expect exception following code happily talks remote server without problems.

try (     final socket socket = sslsocketfactory.getdefault().createsocket(host, port);     final outputstream os = socket.getoutputstream();     final inputstream = socket.getinputstream()) {      os.write(("head / http/1.1\r\nhost: " + host + "\r\nconnection: close\r\n\r\n").getbytes());     os.flush();      final byte[] bytes = new byte[1024];     int n;     while ((n = is.read(bytes)) != -1) {         system.out.print(new string(bytes, 0, n));     }     system.out.println(); } catch (final ioexception e) {     // todo auto-generated catch block     e.printstacktrace(); } 

therefore i've tried approach:

try {     final httpurlconnection conn = (httpurlconnection) new url("https://" + host + ":" + port + "/").openconnection();      try (inputstream = conn.getinputstream()) {         ioutils.copy(is, system.out);     } catch (final ioexception e1) {         try (inputstream es = conn.geterrorstream()) {             if (es != null) {                 ioutils.copy(es, system.out);             }         }     } } catch (final ioexception e) {     // todo auto-generated catch block     e.printstacktrace(); } 

unfortunately still no ssl exception, warn in logs: 2013-07-31 16:02:27,182 warn nio - javax.net.ssl.sslexception: received fatal alert: certificate_unknown

how ssl exception if certificate doesn't match?

the ssl/tls protocol specification modular , detached specifications used authenticate remote host. these other specifications split 2 categories: verifying certificate can trusted (rfc 3280/5280) , verifying identity in certificate (rfc 6125, or rfc 2818 https).

the jsse integrates ssl protocol , verification of certificate in sslsocket (or sslengine) api, doesn't handle verification of identifier (whch equally important).

this due fact sslsocket/sslengine can apply application protocol (e.g. http, imap, smtp, ldap, ...), rules verifying identifier in different specifications (with small variations), until rfc 6125 (which still quite recent).

httpsurlconnection handles both, because uses hostnameverifier, follows https specification (rfc 2818, section 3.1). done separately sslsocket/sslengine api. other protocols, may need implement protocol specification says.

this being said, since java 7, there mechanism verify identity of certificate directly part of sslsocket/sslengine api.

sslparameters sslparams = new sslparameters(); sslparams.setendpointidentificationalgorithm("https"); sslsocket.setsslparameters(sslparams); 

using should make throw exception if host name doesn't match.

there aren't major differences between https , more uniform specifications in rfc 6125 (besides fact latter considers ip addresses out of scope). if you're not using https, still make sense use identification specifications other protocols. (perhaps "rfc 6125" endpoint identification algorithm might come in later versions of java.)