> Fix Java's No subject alternative names matching IP address … found: connect by DNS name or reissue the certificate with an IP SAN. DNS variant too. Source: https://pkizerotohero.com/errors/java-no-subject-alternative-names/ · Last reviewed: 2026-10-20 - Java # No subject alternative names matching IP address … found Also seen in: Spring Boot, JDBC drivers, Kafka clients, Elasticsearch clients, Jenkins, Kotlin, Scala **In one sentence:** Java connected to an IP address, and the server's certificate has no matching IP entry in its Subject Alternative Name list; DNS names never match an IP address. [Check yours: Hostname matcher](https://pkizerotohero.com/tools/hostname/) ## Where you see it In Java programs that connect over TLS to an IP address: JDBC URLs, Kafka bootstrap servers, Elasticsearch and other cluster clients, health checks and scripts. Java’s hostname check throws a `CertificateException`, which reaches you inside an `SSLHandshakeException`: ```text javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found ... Caused by: java.security.cert.CertificateException: No subject alternative names matching IP address 10.0.0.5 found ``` Newer Java releases (JDK 23 and later, 21.0.9 and later, 17.0.19 and later) put the TLS alert in front of the outer message: `(certificate_unknown) No subject alternative names matching IP address 10.0.0.5 found`. The same check, in OpenJDK’s [`HostnameChecker`](https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/sun/security/util/HostnameChecker.java), reports three related variants: ```text java.security.cert.CertificateException: No subject alternative DNS name matching api.internal.example.com found. java.security.cert.CertificateException: No subject alternative names present java.security.cert.CertificateException: No name matching api.internal.example.com found ``` ## What it means A certificate lists the names and addresses it is valid for in its [Subject Alternative Name](https://pkizerotohero.com/handbook/glossary/#subject-alternative-name) (SAN) extension. Java checks an IP address only against `IP Address` entries, never against DNS names and never against the Common Name. The certificate was trusted, but it does not contain the IP address you connected to, so Java refuses it. ## Likely causes ### You connect by IP address, and the certificate only has DNS names The most common case. Look at what the certificate contains: ```bash openssl s_client -connect 10.0.0.5:443 -servername db.internal.example.com /dev/null | openssl x509 -noout -subject -ext subjectAltName ``` ```text subject=CN=db.internal.example.com X509v3 Subject Alternative Name: DNS:db.internal.example.com ``` **Fix 1 (preferred):** connect by the DNS name in the certificate, for example `jdbc:postgresql://db.internal.example.com:5432/app` instead of `jdbc:postgresql://10.0.0.5:5432/app`. If there is no DNS record, ask for one; names survive IP changes, addresses do not. **Fix 2:** if clients must use the address, reissue the certificate with an IP entry. With a private CA: ```bash openssl req -new -key server.key -subj "/CN=db.internal.example.com" \ -addext "subjectAltName=DNS:db.internal.example.com,IP:10.0.0.5" -out server.csr ``` Check that your CA copies the requested SANs into the certificate. Public CAs do not issue certificates for private (reserved) IP addresses. ### A cluster hands out IP addresses Your configuration uses a name, but the error still shows an IP. Clustered systems often tell clients where to connect next: Kafka through `advertised.listeners`, Elasticsearch through its publish address, service discovery through IP-based endpoints. Configure those to advertise DNS names that are in the certificates, or issue node certificates that include their IP addresses. ### The DNS name is not in the certificate For `No subject alternative DNS name matching … found.`, the name you use is missing from the SAN list. Compare with the `openssl x509 -ext subjectAltName` output above; connect with a listed name or reissue the certificate with every name clients use. Remember that `*.example.com` covers exactly one label, not `example.com` and not `a.b.example.com`. ### The certificate has no SAN at all `No subject alternative names present` means you connected by IP address and the certificate has no SAN extension at all. `No name matching … found` means you connected by name, the certificate has no DNS entries in its SAN, and Java’s fallback to the Common Name did not match either. Old internal certificates often look like this. Reissue them with a SAN list; browsers and Go do not accept a name that is only in the Common Name. ### The server sends another certificate than you expect A server or load balancer with several certificates chooses one by the name in [SNI](https://pkizerotohero.com/handbook/glossary/#sni). When you connect by IP address, Java sends no SNI, and you may get a default certificate. Connect by name, or check what each name returns with `openssl s_client -servername`. Warning Do not switch off hostname verification A `HostnameVerifier` that returns `true`, an empty `ssl.endpoint.identification.algorithm` in Kafka, or driver options that skip host checks accept a valid certificate for any other server, which is exactly what an attacker can present. Use the right name, or put the right address in the certificate. ## Check yours *Interactive tool: Hostname matcher (runs in the browser at [/tools/hostname/](https://pkizerotohero.com/tools/hostname/))* Paste the server’s certificate and type the IP address or name you connect to. The matcher shows the SAN entries and why an address does not match a DNS name. ## Learn why - [Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/) - [The TLS 1.3 handshake](https://pkizerotohero.com/handbook/tls-handshake/): SNI and default certificates. - Related: [PKIX path building failed](https://pkizerotohero.com/errors/java-pkix-path-building-failed/) (the trust problem in Java), [Hostname mismatch in Python](https://pkizerotohero.com/errors/python-hostname-mismatch/). **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/java-no-subject-alternative-names/). Last reviewed 20 October 2026Edition 0.9 ## Learn why it happens - [Chapter 9: Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/) ## Fix it step by step - [How to create a key and a CSR with OpenSSL (with SANs)](https://pkizerotohero.com/guides/create-csr-openssl/) - [How to create a CSR with Java keytool](https://pkizerotohero.com/guides/create-csr-java-keytool/) - [How to add a CA to a Java trust store (cacerts)](https://pkizerotohero.com/guides/add-root-ca-java/) ## Everything on this topic - [Certificates](https://pkizerotohero.com/topics/certificates/)