{"record":{"id":"16685585881b069a","repo":"arduino/Arduino","slug":"hostname-r-doesn-t-match-either-of-s","errorCode":null,"errorMessage":"hostname %r doesn't match either of %s","messagePattern":"hostname %r doesn't match either of (.+?)","errorType":"exception","errorClass":"CertificateError","httpStatus":null,"severity":"critical","filePath":"arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/packages/ssl_match_hostname/__init__.py","lineNumber":52,"sourceCode":"    san = cert.get('subjectAltName', ())\n    for key, value in san:\n        if key == 'DNS':\n            if _dnsname_to_pat(value).match(hostname):\n                return\n            dnsnames.append(value)\n    if not dnsnames:\n        # The subject is only checked when there is no dNSName entry\n        # in subjectAltName\n        for sub in cert.get('subject', ()):\n            for key, value in sub:\n                # XXX according to RFC 2818, the most specific Common Name\n                # must be used.\n                if key == 'commonName':\n                    if _dnsname_to_pat(value).match(hostname):\n                        return\n                    dnsnames.append(value)\n    if len(dnsnames) > 1:\n        raise CertificateError(\"hostname %r \"\n            \"doesn't match either of %s\"\n            % (hostname, ', '.join(map(repr, dnsnames))))\n    elif len(dnsnames) == 1:\n        raise CertificateError(\"hostname %r \"\n            \"doesn't match %r\"\n            % (hostname, dnsnames[0]))\n    else:\n        raise CertificateError(\"no appropriate commonName or \"\n            \"subjectAltName fields were found\")\n","sourceCodeStart":34,"sourceCodeEnd":62,"githubUrl":"https://github.com/arduino/Arduino/blob/a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee/arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/packages/ssl_match_hostname/__init__.py#L34-L62","documentation":"match_hostname() raises CertificateError(\"hostname %r doesn't match either of %s\") when the connecting hostname matches none of the certificate's subjectAltName DNS entries (and none of its commonName fallbacks). This is the core TLS hostname-verification failure: the certificate presented is not valid for the name you connected to.","triggerScenarios":"Connecting to 'api.example.com' with a cert whose SANs only cover 'example.com' or other hosts; using an IP address as hostname when the cert lists DNS names only; connecting via a hostname not listed in a self-signed or internal-CA cert; wildcard mismatch such as cert '*.example.com' vs 'a.b.example.com'.","commonSituations":"Internal services using certs issued for different hostnames; staging environments reusing production certs; missing SAN entries on newly issued certs (CN-only certs also fail when CN doesn't match); tools that disabled verification in dev then hit real verification in prod.","solutions":["Inspect the cert (openssl s_client -connect host:443) and compare its SAN DNS entries with the hostname you connect to.","Connect using a hostname that appears in the cert's SANs instead of the IP or an alias.","Reissue the certificate including the required hostname in subjectAltName.","If using an internal CA, add the host to the cert or update your DNS/aliases; never disable verification as a fix.","Catch CertificateError and abort the connection rather than proceeding unverified."],"exampleFix":"// before\nsock = ssl.wrap_socket(s, cert_reqs=ssl.CERT_REQUIRED)\nmatch_hostname(sock.getpeercert(), '10.0.0.5')  # IP not in cert\n// after\nsock = ssl.wrap_socket(s, cert_reqs=ssl.CERT_REQUIRED, server_hostname='api.example.com')\nmatch_hostname(sock.getpeercert(), 'api.example.com')","handlingStrategy":"try-catch","validationCode":"import ssl\nexpected = 'api.example.com'\ncert = ssl.get_server_certificate((expected, 443))  # or inspect SANs via socket\n# verify expected appears in the cert's subjectAltName DNS entries before connecting","typeGuard":null,"tryCatchPattern":"try:\n    match_hostname(cert, hostname)\nexcept CertificateError as e:\n    log.error('hostname verification failed: %s', e)\n    raise  # abort the connection; do not proceed unverified","preventionTips":["Always connect by a hostname listed in the certificate's subjectAltName, not an IP or alias.","Reissue certs with all needed SAN entries (including internal hostnames).","Run `openssl s_client -connect host:443` to inspect SANs during deployment.","Never disable hostname verification to work around a mismatch.","Catch CertificateError and fail the connection instead of falling back to unverified mode."],"tags":["ssl","tls","certificate","hostname-verification","python"],"backgroundTag":"certificate-hostname-mismatch","analyzedSha":"a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee","analyzedAt":"2026-09-06T10:13:38.901Z","contentChangedAt":"2026-09-06T10:13:38.901Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}