Skip to content
ecdsa.com
Java (JSSE HostnameChecker)Java

Error message

No subject alternative names present

Also printed as

  • java.security.cert.CertificateException: No subject alternative names present

JDK 21 and later prefix the exception text with "(certificate_unknown) ". For DNS host names, a certificate without SANs can still match through the Common Name in Java; other clients (Go, Chrome) reject such certificates outright.

Java (JSSE HostnameChecker) — certificate without a SAN extension, URL host is an IP address

What it means

The server's certificate has no Subject Alternative Name extension at all, and the client connected by IP address. For IP addresses Java requires an IP SAN entry and never falls back to the Common Name, so with no SAN extension there is nothing to compare. It is the typical result of certificates generated by old scripts with only a CN.

Why it happens

How to fix it

  1. 1.

    Confirm that the SAN extension is missing

    Print the subject and subjectAltName; no SAN output means the certificate has to be reissued.

    bash
    openssl x509 -in server.pem -noout -subject -ext subjectAltName
# "No extensions in certificate" / no SAN output -> the certificate must be reissued
  2. 2.

    Reissue with subjectAltName

    Add DNS and, where needed, IP entries; keep the CN for display only.

    bash
    openssl req -new -key server.key -out server.csr -subj "/CN=api.example.com" \
  -addext "subjectAltName=DNS:api.example.com,IP:10.0.0.5"
# keytool (Java keystores)
keytool -genkeypair -alias server -keyalg EC -groupname secp256r1 -dname "CN=api.example.com" \
  -ext "SAN=dns:api.example.com,ip:10.0.0.5" -keystore server.p12 -storepass changeit

Related errors

Browse the full signature error database