SSL Certificate without host name in it

Question

I have implemented a web service with server and client authentication using keytool. The problem is that this authentication doesn't work if I don't include the name of the host in it. For example:

keytool -genkey -alias myAlias -keyalg RSA -keypass myPassword -storepass myPassword -keystore my.keystore -dname "CN=myhost"

But I don't need and I don't like validation by host or by IP. Is there any way of avoiding it?

Thanks.

Answer 1

SSL has, as part of it's requirements, validation that the certificate CN matches the hostname that you're connecting to. If the CN doesn't match, then the browser will assume that you're connecting to the wrong host and object.

There is no way around this.

Answer 2

I agree with the other posters: if you are using SSL, you almost certainly want hostname verification as part of the SSL security feature set.

That said, depending on the client you are using, there may very well be a way around this issue. Engineers will circumvent hostname verification in test environments, for debugging, prototyping, etc. If you are using a Java client which connects via HttpsURLConnection, it would be as simple as adding the following to your client class:

static {
    HttpsURLConnection.setDefaultHostnameVerifier( 
        new HostnameVerifier(){
            public boolean verify(String string,SSLSession ssls) {
            return true;
        }
    });
}