Comments on: Host name verification in HTTPS

By: Tony T.

Tony T. — Sat, 20 Nov 2010 03:17:48 +0000

Rupesh,
OK, I see how test would be undefined. But the real question is am I correctly implementing the custom hostnameVerifier? I followed the steps above, minus the cfdump and made a call to a secure web service but I still received an error that said the host name did not match the certificate name. Any thoughts?

Thanks.

By: Rupesh Kumar

Rupesh Kumar — Fri, 19 Nov 2010 14:25:48 +0000

@Tony,
If you see the signature of setDefaultHosnameVerifier(), it returns void. So, the method does not return anything and thus if you assign the result to test, it will of course be undefined.

By: Tony T.

Tony T. — Thu, 18 Nov 2010 03:59:28 +0000

It looks like the code is getting stripped out. Here’s a version of the code without the cfset tags and the pound signs:

verifier= CreateObject(”java”,”MyHostnameVerifier”)
HttpsURLConnection = CreateObject(”java”, “javax.net.ssl.HttpsURLConnection”)t test=HttpsURLConnection.setDefaultHosnameVerifier(veriifer)
cfdump var=”test”
Error: Test is undefined.

By: Tony T.

Tony T. — Thu, 18 Nov 2010 03:56:05 +0000

HI Rupesh,

Here’s the code that got dropped from my last post:

Error: Test is undefined.

Thanks again for the help.

By: Rupesh Kumar

Rupesh Kumar — Mon, 15 Nov 2010 14:11:38 +0000

Hi Tony, I cant see the code that you posted. Can you post that once again?

By: Tony T.

Tony T. — Mon, 15 Nov 2010 02:17:14 +0000

Hi Rupesh,

I have a situation that is virtually identical to the one you described above. I’m trying to access a web service via HTTPS but the host name does not match the certificate name. I could use some advice on how to actually implement your code.
I took your code for a simple HostNameVerifier class, compiled it and saved it in the appropriate directory on my server. The custom class is called MyHostNameVerifier. I then implemented the following code:

I then get the error message “test is undefined.”

Any advise would be greatly appreciated. Thanks in advance.

By: Marco Antonio C Santos

Marco Antonio C Santos — Thu, 27 May 2010 19:45:25 +0000

Hi Rupesh… how to say to CF 8 to ignore host name validation using setDefaultHostnameVerifier.
Cheers

By: Bien

Bien — Wed, 11 Jul 2007 21:46:00 +0000

Using com.sun.net.ssl.HttpsURLConnection instead of javax.net.ssl.HttpsURLConnection did the trick for me. Thanks a lot!

By: Andy Allan

Andy Allan — Thu, 24 Nov 2005 15:35:00 +0000

Excellent posts Rupesh! Keep them coming.