Salesforce Certificate Exception: No subject alternative DNS name matching found

Question

We are trying to make a callout to "https://support.dreamwares.com/payment/v1/accounts/somevalue" from Salesforce. But, we are facing an exception:

System.CalloutException: java.security.cert.CertificateException: No subject alternative DNS name matching support.dreamwares.com found.

The domain has a valid SSL certificate.

We have checked from SSL shopper: https://www.sslshopper.com/ssl-checker.html?submit=submit&hostname=support.dreamwares.com

But, still we are facing this issue

We don't understand why is Salesforce not allowing us to make call outs to this domain when it has a valid SSL certificate and the browsers allow it.

We understand that Salesforce only supports the certificates from trusted CA authorities as listed on

https://developer.salesforce.com/page/Outbound_Messaging_SSL_CA_Certificates

Our certificate provider is GoDaddy which is listed in the list in above link. Our our fingerprint matches with godaddyclass2ca

Simple steps to recreate the issue are as follows-

1. Create a remote site setting for URL - "https://support.dreamwares.com"

2. Execute the following code from developer console -

   HttpRequest httpReq = new HttpRequest();
   Http httpObj = new Http();
   HttpResponse httpResp = new HttpResponse();
   
   httpReq.setEndPoint('https://support.dreamwares.com/payment/accounts/orgid'); 
   httpReq.setMethod('GET');
   
   httpResp = httpObj.send(httpReq);
   

3. The execution will fail. Check debug logs for details of exception

What is the reason for this issue?

Answer 1

It turns out, as you said, that you can't have multiple certificates on the same IP address. Why every other browser and network service can handle this but Salesforce can't, I have no idea.

We were using a shared hosting provider, and once we got a dedicated IP address and put our sub-domain on that dedicated IP address, it worked.

Now, if only Salesforce would update it's error message to include the fact they don't work with wildcards or multiple certs on one IP address.

stony

Answer 2

It means that the webiste you are calling with HTTPS has a domain name that is different from what you're using. i.e you're calling "https://api.myservice.com", and the website's certificate is only for www.myservice.com, you get this error.

It can also happen when multiple certificates are hosted on the same IP address or the certificate is a wildcard certificate i.e. *.breadwinnerhq.com

Answer 3

We are using wildcard certificate for our domain which works absolutely fine. Search for a utility called SSLPoke if you get successfully connected it will sure work with salesforce