{"record":{"id":"e0a291a47bc012df","repo":"apache/hadoop","slug":"certificate-for-hosts-0-doesn-t-contain-cn-or-d","errorCode":null,"errorMessage":"Certificate for {hosts[0]} doesn't contain CN or DNS subjectAlt","messagePattern":"Certificate for (.+?) doesn't contain CN or DNS subjectAlt","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLHostnameVerifier.java","lineNumber":411,"sourceCode":"            final Set<String> names = new TreeSet<String>();\n            if (cns != null && cns.length > 0 && cns[0] != null) {\n                names.add(cns[0]);\n                if (ie6) {\n                    for (int i = 1; i < cns.length; i++) {\n                        names.add(cns[i]);\n                    }\n                }\n            }\n            if (subjectAlts != null) {\n                for (int i = 0; i < subjectAlts.length; i++) {\n                    if (subjectAlts[i] != null) {\n                        names.add(subjectAlts[i]);\n                    }\n                }\n            }\n            if (names.isEmpty()) {\n                String msg = \"Certificate for \" + hosts[0] + \" doesn't contain CN or DNS subjectAlt\";\n                throw new SSLException(msg);\n            }\n\n            // StringBuilder for building the error message.\n            buf = new StringBuilder();\n\n            boolean match = false;\n            out:\n            for (Iterator<String> it = names.iterator(); it.hasNext();) {\n                // Don't trim the CN, though!\n                final String cn = StringUtils.toLowerCase(it.next());\n                // Store CN in StringBuilder in case we need to report an error.\n            buf.append(\" <\")\n            .append(cn)\n            .append('>');\n                if (it.hasNext()) {\n                    buf.append(\" OR\");\n                }\n","sourceCodeStart":393,"sourceCodeEnd":429,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLHostnameVerifier.java#L393-L429","documentation":"Error \"Certificate for {hosts[0]} doesn't contain CN or DNS subjectAlt\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLHostnameVerifier.java:411 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate or replace the server certificate so it contains a Common Name (CN) or a DNS subjectAltName matching the host.","Verify the certificate presented is the intended one and the keystore is not misconfigured.","Connect using the hostname that matches the certificate's CN/SAN."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}