By: Tiago Fernandes user 09 Feb 2022 at 10:09 a.m. CST

1 Response
Tiago Fernandes gravatar
We are deploying gluu in a "dockerized" environment using helm charts. When deploying the oxtrust container, it starts complaining with the following error message: ``` 2022-02-09 15:42:20,370 ERROR [Thread-330] [org.gluu.oxtrust.ldap.service.StatusCheckerTimer] (StatusCheckerTimer.java:226) - Can not download ssl certificate javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching <xxxxx.xxxxxx.com> found. at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[?:1.8.0_212] at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1946) ~[?:1.8.0_212] at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:316) ~[?:1.8.0_212] at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310) ~[?:1.8.0_212] at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639) ~[?:1.8.0_212] at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223) ~[?:1.8.0_212] at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) ~[?:1.8.0_212] at sun.security.ssl.Handshaker.process_record(Handshaker.java:965) ~[?:1.8.0_212] at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064) ~[?:1.8.0_212] at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367) ~[?:1.8.0_212] at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395) ~[?:1.8.0_212] at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379) ~[?:1.8.0_212] at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559) ~[?:1.8.0_212] at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185) ~[?:1.8.0_212] at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:162) ~[?:1.8.0_212] at org.gluu.oxtrust.ldap.service.StatusCheckerTimer.setCertificateExpiryAttributes(StatusCheckerTimer.java:215) [classes/:?] at org.gluu.oxtrust.ldap.service.StatusCheckerTimer.processInt(StatusCheckerTimer.java:164) [classes/:?] at org.gluu.oxtrust.ldap.service.StatusCheckerTimer.process(StatusCheckerTimer.java:131) [classes/:?] at org.gluu.oxtrust.ldap.service.StatusCheckerTimer$Proxy$_$$_WeldSubclass.process$$super(Unknown Source) [classes/:?] at sun.reflect.GeneratedMethodAccessor231.invoke(Unknown Source) ~[?:?] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_212] at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_212] at org.jboss.weld.interceptor.proxy.TerminalAroundInvokeInvocationContext.proceedInternal(TerminalAroundInvokeInvocationContext.java:51) [weld-core-impl-3.1.2.Final.jar:3.1.2.Final] at org.jboss.weld.interceptor.proxy.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:78) [weld-core-impl-3.1.2.Final.jar:3.1.2.Final] at org.gluu.service.cdi.async.AsynchronousInterceptor$1.get(AsynchronousInterceptor.java:36) [oxcore-service-4.1.1.Final.jar:?] at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1590) [?:1.8.0_212] at java.lang.Thread.run(Thread.java:748) [?:1.8.0_212] Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching <xxxxx.xxxxxx.com> found. at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:214) ~[?:1.8.0_212] at sun.security.util.HostnameChecker.match(HostnameChecker.java:96) ~[?:1.8.0_212] at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455) ~[?:1.8.0_212] at sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:1125) ~[?:1.8.0_212] at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1092) ~[?:1.8.0_212] at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621) ~[?:1.8.0_212] ``` OxAuth container and Opendj containers seem OK at first glance through the logs. Any help or pointers you can provide to find a solution would be most helpful. Thank you in advance.

By Mohib Zico staff 22 Feb 2022 at 11:39 a.m. CST

Mohib Zico gravatar
Hi Tiago, Is it local computer based docker deployment ( VMWare / Virtualbox )? The hostname you are using is DNS resolvable? Are you using default ingress?