When running a report via CLI it fails with :java.security.cert.CertificateException: No subject alternative DNS name matching localhost found.

Products

• Automation Analytics & Intelligence

Issue/Introduction

When attempting to run an AAI report via CLI it fails with the error below:

Traceback (most recent call last):

  File "/apps/JAWS/batch/lib/run_report.py", line 330, in <module>

    main()

  File "/apps/JAWS/batch/lib/run_report.py", line 136, in main

    url, criteria = run(report_name)

  File "/apps/JAWS/batch/lib/run_report.py", line 187, in run

    params.login_with_params()

  File "/apps/JAWS/batch/lib/params.py", line 97, in login_with_params

    jaws.login(user=overridden['user'],

  File "/apps/JAWS/batch/lib/jaws.py", line 337, in login

    select_server(host=host, http_port=http_port, http_protocol=http_protocol, disable_cert=disable_cert, skip_server_contact=False, skip_version_check=skip_version_check)

  File "/apps/JAWS/batch/lib/jaws.py", line 146, in select_server

    stream = info_url.openStream()

  File "/apps/JAWS/batch/lib/jaws.py", line 146, in select_server

    stream = info_url.openStream()

        at sun.security.ssl.Alert.createSSLException(Alert.java:131)

        at sun.security.ssl.TransportContext.fatal(TransportContext.java:370)

        at sun.security.ssl.TransportContext.fatal(TransportContext.java:313)

        at sun.security.ssl.TransportContext.fatal(TransportContext.java:308)

        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:652)

        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:471)

        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:367)

        at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:376)

        at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:479)

        at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:457)

        at sun.security.ssl.TransportContext.dispatch(TransportContext.java:200)

        at sun.security.ssl.SSLTransport.decode(SSLTransport.java:155)

        at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1320)

        at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1233)

        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:417)

        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:389)

        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:558)

        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:201)

        at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1584)

        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1512)

        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:268)

        at java.net.URL.openStream(URL.java:1092)

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

        at java.lang.reflect.Method.invoke(Method.java:498)

javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching localhost found.

Environment

Release : 6.4.4

Resolution

When running an AAI CLI command when you are configured to use HTTPS you must specify a host name that is listed as a Subject Name or Subject Alternative Name within the certificate that was imported into the AAI keystore file.

 

To do this you must specify the hostname with the "-server" option in the CLI.

 

For example:

/opt/aai/batch/run.pl /opt/aai/batch/lib/run_report.py -server aaiHostName -port 8443 -protocol https -disable_cert