apache/hadoop · error · SSLException

Certificate for {hosts[0]} doesn't contain CN or DNS subject

Error message

Certificate for {hosts[0]} doesn't contain CN or DNS subjectAlt

What it means

Error "Certificate for {hosts[0]} doesn't contain CN or DNS subjectAlt" thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLHostnameVerifier.java:411

            final Set<String> names = new TreeSet<String>();
            if (cns != null && cns.length > 0 && cns[0] != null) {
                names.add(cns[0]);
                if (ie6) {
                    for (int i = 1; i < cns.length; i++) {
                        names.add(cns[i]);
                    }
                }
            }
            if (subjectAlts != null) {
                for (int i = 0; i < subjectAlts.length; i++) {
                    if (subjectAlts[i] != null) {
                        names.add(subjectAlts[i]);
                    }
                }
            }
            if (names.isEmpty()) {
                String msg = "Certificate for " + hosts[0] + " doesn't contain CN or DNS subjectAlt";
                throw new SSLException(msg);
            }

            // StringBuilder for building the error message.
            buf = new StringBuilder();

            boolean match = false;
            out:
            for (Iterator<String> it = names.iterator(); it.hasNext();) {
                // Don't trim the CN, though!
                final String cn = StringUtils.toLowerCase(it.next());
                // Store CN in StringBuilder in case we need to report an error.
            buf.append(" <")
            .append(cn)
            .append('>');
                if (it.hasNext()) {
                    buf.append(" OR");
                }

View on GitHub (pinned to 2add963021)

Solutions

1. Regenerate or replace the server certificate so it contains a Common Name (CN) or a DNS subjectAltName matching the host.
2. Verify the certificate presented is the intended one and the keystore is not misconfigured.
3. Connect using the hostname that matches the certificate's CN/SAN.

When it happens

Trigger: Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLHostnameVerifier.java:411 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/e0a291a47bc012df. Report an issue: GitHub.