No subject alternative names matching IP address 127.0.0.1 found

The address is the one from your URL; JDK 21 and later prefix the exception text with "(certificate_unknown) ". For DNS host names the message is "No subject alternative DNS name matching <host> found."

Java (JSSE HostnameChecker) — URL host is an IP address that is not an IP SAN of the certificate

What it means

The URL's host is an IP address, and the certificate has no IP-address entry in its Subject Alternative Name extension that equals it. Java (per RFC 6125) compares IP addresses only with IP SAN entries; DNS names and the Common Name never match an address.

Why it happens

• The client connects by IP address

  common

  Configuration files, JDBC URLs and service registries that store IP addresses instead of host names.

• Cluster-internal traffic to pod or node addresses

  common

  Service discovery that hands out IP addresses (pods, nodes, cloud instances) while certificates carry service names.

• The certificate was meant for IP access but lacks the IP SAN

  occasional

  Putting the IP address into the Common Name does not work; it must be an IP entry in subjectAltName.

How to fix it

1. 1.

   Connect by a DNS name the certificate lists

   Use the host name and resolve it to the needed address; hostname verification then succeeds.

   # Use the DNS name from the certificate; map it to the IP where needed
   echo "10.0.0.5 api.example.com" | sudo tee -a /etc/hosts
   curl -sI https://api.example.com/

2. 2.

   Issue the certificate with an IP SAN

   When clients must use the address, add it as an IP entry (public CAs rarely issue these; private CAs can).

   # Or issue the certificate with the IP address as an IP SAN entry
   openssl req -new -key server.key -out server.csr -subj "/CN=api.example.com" \
     -addext "subjectAltName=DNS:api.example.com,IP:10.0.0.5"
   keytool -certreq -alias server -keystore server.p12 -ext "SAN=dns:api.example.com,ip:10.0.0.5" -file server.csr

← Browse the full signature error database