javax.net.ssl.SSLHandshakeException: (unrecognized_name) Received fatal alert: unrecognized_name

JDK 25 reports "(unrecognized_name) Received fatal alert: unrecognized_name". Java 7 and early Java 8 releases also aborted when a server sent this alert merely as a warning, a classic with Apache httpd configurations lacking a matching ServerName.

Java (JSSE) — TLS alert 112 from a server that does not serve the requested SNI name

What it means

The JVM sent the host name from the URL as SNI, and the server answered with TLS alert 112 (unrecognized_name) as a fatal alert because it has no site configured for that name. Java treats the alert as fatal and stops. The server is reachable; it just does not recognise the name you used.

Why it happens

• The server has no site for that name

  common

  A new DNS name (or a CNAME to a platform or CDN) points at a server where the name was never added.

• The client uses an alias the server does not list

  common

  Internal or legacy names in client configuration that the server's virtual hosts do not include.

• Apache httpd without a matching ServerName

  occasional

  Apache sends unrecognized_name when no TLS virtual host's ServerName or ServerAlias matches the SNI name.

How to fix it

1. 1.

   Find the names the server accepts

   Try the handshake with candidate names using openssl s_client -servername.

   # Which SNI names does the server accept?
   for n in api.example.com www.example.com; do
     printf '%-18s ' "$n"
     echo | openssl s_client -connect api.example.com:443 -servername "$n" -brief 2>&1 | grep -m1 -E 'Protocol version|alert' || echo fail
   done

2. 2.

   Add the name to the server

   Configure ServerName or ServerAlias (or the equivalent in nginx, the CDN or the platform) together with a certificate covering it.

   # Apache httpd: every name clients use must be a ServerName or ServerAlias of a TLS vhost
   <VirtualHost *:443>
       ServerName  api.example.com
       ServerAlias api-legacy.example.com
       SSLEngine on
   </VirtualHost>

3. 3.

   Use the configured host name

   Prefer fixing the URL over disabling SNI globally.

   Use the server's configured host name in the URL. Turning SNI off with
   -Djsse.enableSNIExtension=false only works if the server's default site is the one you need,
   and it breaks every server that relies on SNI; avoid it.

← Browse the full signature error database