{"record":{"id":"c545ce62e82d187f","repo":"arduino/Arduino","slug":"hostname-r-doesn-t-match-r","errorCode":null,"errorMessage":"hostname %r doesn't match %r","messagePattern":"hostname %r doesn't match %r","errorType":"exception","errorClass":"CertificateError","httpStatus":null,"severity":"error","filePath":"arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/packages/ssl_match_hostname/__init__.py","lineNumber":56,"sourceCode":"                return\n            dnsnames.append(value)\n    if not dnsnames:\n        # The subject is only checked when there is no dNSName entry\n        # in subjectAltName\n        for sub in cert.get('subject', ()):\n            for key, value in sub:\n                # XXX according to RFC 2818, the most specific Common Name\n                # must be used.\n                if key == 'commonName':\n                    if _dnsname_to_pat(value).match(hostname):\n                        return\n                    dnsnames.append(value)\n    if len(dnsnames) > 1:\n        raise CertificateError(\"hostname %r \"\n            \"doesn't match either of %s\"\n            % (hostname, ', '.join(map(repr, dnsnames))))\n    elif len(dnsnames) == 1:\n        raise CertificateError(\"hostname %r \"\n            \"doesn't match %r\"\n            % (hostname, dnsnames[0]))\n    else:\n        raise CertificateError(\"no appropriate commonName or \"\n            \"subjectAltName fields were found\")\n","sourceCodeStart":38,"sourceCodeEnd":62,"githubUrl":"https://github.com/arduino/Arduino/blob/a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee/arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/packages/ssl_match_hostname/__init__.py#L38-L62","documentation":"ssl_match_hostname.match_hostname verifies that the hostname you connected to matches the CommonName or subjectAltName entries in the server's TLS certificate. This CertificateError is raised when the certificate is valid in form but none of its DNS names match the hostname you requested. It is urllib3's vendored copy of Python's stdlib match_hostname, called from connect() during the TLS handshake.","triggerScenarios":"Calling urllib3/requests against https://host while the server presents a certificate whose subjectAltName/CN list contains DNS names, but none equal (or wildcard-match) the requested hostname; e.g. connecting via IP address, a CNAME alias, or 'www.example.com' when the cert only covers 'example.com'.","commonSituations":"Typo in the URL hostname; accessing a load balancer or internal service by IP instead of the name on the cert; server misconfigured to serve the wrong vhost/cert; SNI-less clients hitting a shared host that returns a default cert for another domain; self-signed or staging certs without the required SAN.","solutions":["Use the exact hostname listed in the certificate's subjectAltName (check with `openssl s_client -connect host:443 -servername host | openssl x509 -text | grep -A1 'Subject Alternative Name'`).","Fix DNS so the correct certificate is served (SNI-aware client, correct vhost config).","Reissue the certificate adding the needed SAN entry (e.g. wildcard or the www/internal name).","As a last resort for trusted-but-mismatched internal endpoints, set cert_reqs='CERT_NONE' or assert_hostname to an expected value via a custom HTTPSConnectionPool — never for untrusted traffic."],"exampleFix":"// before\nimport urllib3\nhttp = urllib3.PoolManager()\nr = http.request('GET', 'https://10.0.0.5/api')  # cert is for api.internal.example.com\n// after\nr = http.request('GET', 'https://api.internal.example.com/api')  # hostname matches cert SAN","handlingStrategy":"validation","validationCode":"import socket\nfrom urllib.parse import urlparse\nhost = urlparse(url).hostname\nif host is None or _looks_like_ip(host):\n    raise ValueError('Connect by the certificate hostname, not an IP: %s' % host)\ndef _looks_like_ip(h):\n    try:\n        socket.inet_aton(h)\n        return True\n    except socket.error:\n        return False","typeGuard":null,"tryCatchPattern":"from requests.exceptions import SSLError\ntry:\n    resp = requests.get(url, timeout=10)\nexcept SSLError as e:\n    if 'doesn\\'t match' in str(e):\n        log.error('Hostname/cert mismatch for %s: %s', url, e)\n    raise","preventionTips":["Always connect using the DNS name on the certificate, never a bare IP.","Run `openssl s_client -servername <host>` in CI to assert SANs cover every environment hostname.","Keep staging certs issued with the same SANs as production.","Prefer verify=True (default) and fix certs rather than disabling verification."],"tags":["ssl","certificate","hostname-mismatch","network"],"backgroundTag":"ssl-certificate-verify-failed","analyzedSha":"a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee","analyzedAt":"2026-09-06T10:13:38.901Z","contentChangedAt":"2026-09-06T10:13:38.901Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}