{"record":{"id":"9f6ebe84db70c9db","repo":"redis/jedis","slug":"the-connection-to-hostandport-gethost-fail","errorCode":null,"errorMessage":"The connection to '${_hostAndPort.getHost()}' failed ssl/tls hostname verification.","messagePattern":"The connection to '(.+?)' failed ssl/tls hostname verification\\.","errorType":"exception","errorClass":"JedisConnectionException","httpStatus":null,"severity":"critical","filePath":"src/main/java/redis/clients/jedis/DefaultJedisSocketFactory.java","lineNumber":181,"sourceCode":"    }\n\n    SSLSocket sslSocket = (SSLSocket) _sslSocketFactory.createSocket(socket,\n        _hostAndPort.getHost(), _hostAndPort.getPort(), true);\n\n    // Enable hostname verification by default (HTTPS algorithm).\n    // Users can override by providing custom SSLParameters via JedisClientConfig.\n    if (_sslParameters == null) {\n      _sslParameters = new SSLParameters();\n      _sslParameters.setEndpointIdentificationAlgorithm(\"HTTPS\");\n    }\n\n    sslSocket.setSSLParameters(_sslParameters);\n\n    // allowing HostnameVerifier for both SslOptions and legacy ssl config\n    if (hostnameVerifier != null && !hostnameVerifier.verify(_hostAndPort.getHost(), sslSocket.getSession())) {\n      String message = String.format(\"The connection to '%s' failed ssl/tls hostname verification.\",\n          _hostAndPort.getHost());\n      throw new JedisConnectionException(message);\n    }\n\n    return new SSLSocketWrapper(sslSocket, plainSocket);\n  }\n\n  public void updateHostAndPort(HostAndPort hostAndPort) {\n    this.hostAndPort = hostAndPort;\n  }\n\n  public HostAndPort getHostAndPort() {\n    return this.hostAndPort;\n  }\n\n  protected HostAndPort getSocketHostAndPort() {\n    HostAndPortMapper mapper = hostAndPortMapper;\n    HostAndPort hap = this.hostAndPort;\n    if (mapper != null) {\n      HostAndPort mapped = mapper.getHostAndPort(hap);","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/redis/jedis/blob/6dac31d4c224fb3257c216f3985340c6f500cdcb/src/main/java/redis/clients/jedis/DefaultJedisSocketFactory.java#L163-L199","documentation":"After Jedis wraps the plain socket in an SSL socket, it runs the configured HostnameVerifier against the server certificate's session. If the certificate does not match the host in the HostAndPort used for the connection, it throws JedisConnectionException with 'The connection to <host> failed ssl/tls hostname verification.' This prevents man-in-the-middle attacks where a valid certificate is presented for a different name.","triggerScenarios":"Connecting with ssl=true (or SslOptions) to a server whose TLS certificate CN/SAN does not match the hostname used in the client configuration — e.g. connecting via an IP address, 'localhost', a load balancer/CNAME, or a hostname spelled differently from the certificate; or supplying a restrictive custom HostnameVerifier.","commonSituations":"Pointing the client at a proxy/load balancer whose cert covers a different name; using IP addresses or service internal names (e.g. k8s pod names) not in the cert SANs; self-signed or internally-issued certs; renaming hosts after cert issuance; migrating from plaintext to TLS without updating certs.","solutions":["Use the exact hostname the server certificate was issued for in the client's HostAndPort configuration.","Fix the server certificate: reissue it with SANs covering the hostnames/IPs clients actually connect to.","Provide a custom SslOptions/HostnameVerifier only if you can verify identity another way (e.g. certificate pinning) — never disable verification in production.","Check for hostname mismatch caused by DNS aliases or load balancers and align cert SANs with those names.","Test with 'openssl s_client -connect host:port -servername host' to inspect the served certificate."],"exampleFix":"// before\nJedis jedis = new Jedis(HostAndPort.from(\"10.0.0.5:6380\"),\n    DefaultJedisClientConfig.builder().ssl(true).build()); // cert is for redis.example.com\n\n// after\nJedis jedis = new Jedis(HostAndPort.from(\"redis.example.com:6380\"),\n    DefaultJedisClientConfig.builder().ssl(true).build()); // hostname matches cert","handlingStrategy":"validation","validationCode":"// verify the server cert covers the host before connecting\nimport javax.net.ssl.*;\nSSLContext ctx = SSLContext.getDefault();\nSSLSocketFactory f = ctx.getSocketFactory();\ntry (SSLSocket s = (SSLSocket) f.createSocket(host, port)) {\n  s.startHandshake();\n  if (!HttpsURLConnection.getDefaultHostnameVerifier().verify(host, s.getSession())) {\n    throw new IllegalStateException(\"Cert does not match host \" + host);\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  jedis = new Jedis(hostAndPort, sslConfig);\n} catch (JedisConnectionException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"hostname verification\")) {\n    // align HostAndPort hostname with the certificate SANs, or reissue the cert\n  }\n  throw e;\n}","preventionTips":["Connect using the hostname on the certificate, never bare IPs or unlisted internal aliases.","Issue server certs with SANs covering every hostname/IP clients use (including load balancer names).","Only customize HostnameVerifier for verified internal PKI setups; never return true unconditionally.","Use SslOptions to supply a trust store pinning your CA instead of weakening hostname checks.","Audit cert expirations and SAN coverage as part of TLS rotation."],"tags":["ssl","tls","hostname-verification","security","connection"],"backgroundTag":"ssl-hostname-verification-failed","analyzedSha":"6dac31d4c224fb3257c216f3985340c6f500cdcb","analyzedAt":"2026-09-08T04:55:01.204Z","contentChangedAt":"2026-09-08T04:55:01.204Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}