alibaba/canal · critical · CertificateException

Failed to retrieve the Common Name (CN) from the server cert

Error message

Failed to retrieve the Common Name (CN) from the server certificate.

What it means

Thrown inside checkServerTrusted during VERIFY_IDENTITY hostname matching when LdapName parsing of the certificate subject DN raises InvalidNameException. The code extracts the CN from the RFC2253-formatted subject; if that string violates LDAP naming rules (malformed DN, escaping issues, non-RFC2253 content), parsing aborts and the wrapper cannot obtain a CN to compare against hostName.

Source

Thrown at driver/src/main/java/com/alibaba/otter/canal/parse/driver/mysql/socket/BioSocketChannelPool.java:300

                }

                // verify server certificate identity
                if (this.hostName != null) {
                    logger.info("verify hostName: {}", this.hostName);
                    Set<String> expectHostNames = new HashSet<>();
                    for (X509Certificate certificate : chain) {
                        String dn = certificate.getSubjectX500Principal().getName(X500Principal.RFC2253);
                        String cn = null;
                        try {
                            LdapName ldapDN = new LdapName(dn);
                            for (Rdn rdn : ldapDN.getRdns()) {
                                if (rdn.getType().equalsIgnoreCase("CN")) {
                                    cn = rdn.getValue().toString();
                                    break;
                                }
                            }
                        } catch (InvalidNameException e) {
                            throw new CertificateException(
                                "Failed to retrieve the Common Name (CN) from the server certificate.");
                        }
                        expectHostNames.add(cn);
                    }

                    if (!expectHostNames.contains(this.hostName)) {
                        throw new CertificateException(
                            "Server certificate identity check failed. The certificate Common Name "
                                                       + expectHostNames.stream()
                                                           .map(h -> "'" + h + "'")
                                                           .collect(Collectors.joining(", "))
                                                       + " does not match with '" + this.hostName + "'.");
                    }

                }
            }
        }

View on GitHub (pinned to 87be50e876)

Solutions

Regenerate the server certificate with a standard CN subject (e.g. CN=host.example.com,O=...).
Verify the subject DN with openssl x509 -noout -subject and confirm it is RFC2253-compliant.
If the cert cannot be changed, fall back to SslMode.VERIFY_CA (which skips hostname matching).
Ensure the cert uses standard attribute types (CN, O, OU, C).

Example fix

# before (cert subject malformed)
# subject=BadDN(with parens)
# -> InvalidNameException at handshake

# after (regenerate with standard subject)
openssl req -new -key server.key -subj "/CN=mysql.internal.example.com/O=Example" -out server.csr

Defensive patterns

Strategy: validation

Validate before calling

// Pre-validate the cert subject DN parses as LDAP before enabling VERIFY_IDENTITY
javax.naming.ldap.LdapName n = new javax.naming.ldap.LdapName(
    cert.getSubjectX500Principal().getName(javax.security.auth.x500.X500Principal.RFC2253));

Try / catch

try {
    socketFactory.createSocket(...).startHandshake();
} catch (javax.net.ssl.SSLHandshakeException e) {
    Throwable c = e.getCause();
    if (c instanceof java.security.cert.CertificateException
        && c.getMessage().contains("Common Name")) {
        // regenerate cert with a standard CN, or use VERIFY_CA
    }
    throw e;
}

Prevention

Issue server certs with a standard CN subject (CN=host.example.com).
Validate the DN parses as RFC2253/LdapName before relying on VERIFY_IDENTITY.
Keep DN attribute types standard (CN, O, OU, C).

When it happens

Trigger: VERIFY_IDENTITY mode with a server certificate whose subject DN is not parseable as an LDAP name under RFC2253 (e.g. odd attribute types, broken escaping, or a DN the LdapName class rejects). Triggered during the TLS handshake identity check.

Common situations: Self-signed or custom-CA cert with an unusual DN format; a certificate whose CN uses characters that break RFC2253 parsing; a CA tool that emitted a non-standard subject; JVM version differences in LDAP DN parsing strictness.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of alibaba/canal@87be50e876 (2026-08-14). Data as JSON: /api/errors/da5be9009f76725a. Report an issue: GitHub.