Hi,

As part of HTTPS, at the client, the cn of the server certificate should be
checked against hostname of the URL through which the service is accessed.
In our case, our web server is using a wildcard certificate (i.e. the cn of
the server certificate is something like *.abc.com).  In the client when the
URL of the service is specified, we use something like:
https://box1.abc.com/...

We were expecting that there would be an exception thrown saying *.abc.com
doesn't match box1.abc.com.  However, we do not get any exception and
everything is fine.  So, does axis even check for this or is axis doing
wildcard matching and hence it does match?  (We found that if we write a
standalone client to connect to our webserver using
com.sun.net.ssl.HttpsConnection then in does check for this and complains
and we have to get around it by specifying our own hostname verifier.)

We're using axis 1.0 with jdk 1.3.1 and sun's jsse.

Regards,
Len Takeuchi | Senior Software Engineer | SalesCentrix.com Inc.
mailto:[EMAIL PROTECTED] | Tel: 604-687-1877 x287
http://www.salescentrix.com/
An affordable e-business solution for small to medium-sized manufacturers

Reply via email to