No subject alternative names present SSL / TLS Origin: Network Last updated 4 Nov 2026

Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found

Java checks the hostname against the certificate's SANs and found no matching entry (for DNS names or IPs).

Exact message you may see No subject alternative names presentNo subject alternative names matching IP address foundjava.security.cert.CertificateException: No subject alternative DNS name matchingjavax.net.ssl.SSLHandshakeException: No subject alternative names presentNo name matching host found
Explore the map of this error Full error map →
Seen on: SSL Java

Meaning

Java ignores the legacy Common Name. The certificate must list the host in SAN. When connecting by IP, an IP SAN is required. Reissue the certificate with SANs (-addext subjectAltName=DNS:host,IP:10.0.0.5) or connect using the DNS name.

Common causes

  • Certificate has CN only, no SAN
  • Connecting via IP not covered by an IP SAN
  • Hostname differs from certificate names
  • Dev certificates created without SAN
  • Wildcard not applying at that level

⚡ Quick fix

  1. Reissue with SANs including every DNS name/IP used
  2. Connect by DNS name
  3. Use mkcert or openssl req -addext for development

Detailed fix by platform

Linux

  1. openssl req -x509 -newkey rsa:2048 -nodes -keyout k.pem -out c.pem -days 365 -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

How to diagnose

  1. SAN — Present?
  2. Host — IP or name?
  3. CN — Only?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server certi…Keystore was tampered with, or password was incorrect — Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect (SSL / TLS)Keystore was tampered…no alternative certificate subject name matches target host name — curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com' (SSL / TLS)no alternative certif…PKIX path building failed — javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target (Java)PKIX path building fa…Received fatal alert: handshake_failure — Java: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure (SSL / TLS)Received fatal alert:…SSL_ERROR_BAD_CERT_DOMAIN — Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN (SSL / TLS)SSL_ERROR_BAD_CERT_DO…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during connec…No subjec…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.