Postman SSL Error: Hostname/IP does not match certificate's altnames

[Curtis-Lockley]

The issue
In Postman I have added my ManagementCA.pem as a CA certificate. I have also added my generated .p12 client certificate and tried to do the GET request https://localhost:443/ejbca/ejbca-rest-api/v1/certificate/status. However it shows the error message SSL Error: Hostname/IP does not match certificate's altnames. Does anyone know how to resolve this issue?

Additonal Context
I have worked through the following tutorials as I am new to EJBCA:

• https://docs.keyfactor.com/ejbca/latest/tutorial-start-out-with-ejbca-docker-container
• https://docs.keyfactor.com/ejbca/latest/tutorial-create-your-first-root-ca-using-ejbca
• https://docs.keyfactor.com/ejbca/latest/tutorial-create-a-pki-hierarchy-in-ejbca
• https://docs.keyfactor.com/ejbca/latest/tutorial-issue-tls-server-certificates-with-ejbca
• https://docs.keyfactor.com/ejbca/latest/tutorial-issue-tls-client-certificates-with-ejbca

This is my docker compose file

networks:
  access-bridge:
    driver: bridge
  application-bridge:
    driver: bridge
services:
  ejbca-database:
    container_name: ejbca-database
    image: "library/mariadb:latest"
    networks:
      - application-bridge
    environment:
      - MYSQL_ROOT_PASSWORD=foo123
      - MYSQL_DATABASE=ejbca
      - MYSQL_USER=ejbca
      - MYSQL_PASSWORD=ejbca
    volumes:
      - ./datadbdir:/var/lib/mysql:rw
  ejbca-node1:
    hostname: ejbca-node1
    container_name: ejbca
    image: keyfactor/ejbca-ce:latest
    depends_on:
      - ejbca-database
    networks:
      - access-bridge
      - application-bridge
    environment:
      - DATABASE_JDBC_URL=jdbc:mariadb://ejbca-database:3306/ejbca?characterEncoding=UTF-8
      - LOG_LEVEL_APP=INFO
      - LOG_LEVEL_SERVER=INFO
      - TLS_SETUP_ENABLED=simple
    ports:
      - "80:8080"
      - "443:8443"

I have also made sure all the CA services are active:

I have also ensured that REST Certificate Management is enabled in the system configuration

I have enrolled the end entity on the RA Web by going:

1. Enroll > Make New Request
2. Select TLS Client Profile as the type
3. Select By the CA
4. set the common name and username as Test02
5. set and confirm the enrollment code
6. Download PKCS#12

My ejbca container has the hostname ejbca-node1, but I am trying to do the get request using localhost as I am unable to access the container using ejbca-node1. I would've accessed the web ui through https://localhost/ejbca/adminweb.

[primetomas]

"SSL Error: Hostname/IP does not match certificate's altnames." is a classic TLS error. That means that the hostname you used when issuing the server certificate is not "localhost". You should use the correct hostname, which is encoded in the server certificate in your URL.

[primetomas]

I guess your dnsname in the server certificate is "ejbca-node1" then. You can check that in the web browser easily, just look at the certificate. The you simply do your REST call using the hostname "ejbca-node1" instead of "localhost". Typically you do REST API calls from another host than the same host anyway right?

[Curtis-Lockley]

Looking at my certificates in the RA Web, I have found a few automatically generated server certificates that include ejbca-node1 as the DNS name. Adding a DNS entry into /etc/hosts and swapping the ip in my request to ejbca-node1 resolves my issue and allows me to make GET requests.

root@curtis-VirtualBox:~# cat /etc/hosts
127.0.0.1	localhost
127.0.1.1	curtis-VirtualBox

#Docker EJBCA
127.0.0.1       ejbca-node1

However what if I want to modify it so that I can access the REST API from multiple ip addresses or just a different one than the docker hostname?

[primetomas]

You just issue a new TLS certificate for the host with all the DNSnames you want in it. You can add as many DNS names to a certificate as you like.

[Curtis-Lockley]

Through the web UI, I'm able to issue myself a new server certificate with the ip/dns names that I want. I have tested that previously generated client certificates are validated correctly when using the server certificate on a none-EJBCA service.

However, if I send a HTTP request using the ip/dns in that certificate to the EJBCA api it will give me the SSL error I was originally having. I assume this is due to the EJBCA api still using the auto-generated server certificate that only has ejbca-node1 in its list of DNS names. Currently the only way around for myself and other devices on the network this is to add a DNS entry for ejbca-node1 like in my previous reply.

What steps can I take so that the EJBCA auto-generated certificate includes the ip/dns names that I need or is there a way to make it use the certificate I generated through the UI?

[primetomas]

If it's a software installation you renew/change the wildfly TLS certificate like this. https://docs.keyfactor.com/ejbca/latest/ssl-certificate-expiration