# system.net.httpClient post return exception : No subject alternative names present

**URL:** <https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478>\
**Category:** Ignition\
**Tags:** ignition80, perspective\
**Created:** [January 21, 2021, 12:26pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478 "2021-01-21T12:26:26Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [January 21, 2021, 12:26pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/1 "2021-01-21T12:26:26Z")

</div>

Hi @paul-griffith,

**Ignition 8.1.1**  
I try to connect with https to a rest webservices on my LAN.

I have the following error:  
**Caused by: com.inductiveautomation.ignition.common.GenericTransferrableException: No subject alternative names present**

I use **bypass\_cert\_validation=True**.

I try to add  
wrapper.java.additional.7=-Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true  
and restarted the gateway, but I still have the same exception.

Any idea ???

```auto
	client = system.net.httpClient(bypass_cert_validation=True,username="admin", password="admin")
	response = client.post(url="https://10.100.3.31:443/api/api-token-auth/",username="admin", password="admin")
	
	# Validate the response
	if response.good:
	    # Do something with the response
	    print response.json

```

```auto
13:35:28.866 [AWT-EventQueue-0] ERROR com.inductiveautomation.ignition.client.util.gui.ErrorUtil - Error running action 'component.onActionPerformed' on pages/HOME@D/root/Button_19: Traceback (most recent call last):
  File "<function:runAction>", line 3, in runAction
	at com.inductiveautomation.ignition.common.script.builtin.http.JythonHttpClient.send(JythonHttpClient.java:94)
	at com.inductiveautomation.ignition.common.script.builtin.http.JythonHttpClient.post(JythonHttpClient.java:308)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
java.io.IOException: java.io.IOException: Unable to POST https://10.100.3.31:443/api/api-token-auth/

com.inductiveautomation.ignition.common.GenericTransferrableException: Traceback (most recent call last):
  File "<function:runAction>", line 3, in runAction
	at com.inductiveautomation.ignition.common.script.builtin.http.JythonHttpClient.send(JythonHttpClient.java:94)
	at com.inductiveautomation.ignition.common.script.builtin.http.JythonHttpClient.post(JythonHttpClient.java:308)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
java.io.IOException: java.io.IOException: Unable to POST https://10.100.3.31:443/api/api-token-auth/

	at org.python.core.Py.JavaError(Py.java:552)
	at org.python.core.Py.JavaError(Py.java:543)
	at org.python.core.PyReflectedFunction. __call__ (PyReflectedFunction.java:190)
	at org.python.core.PyObject. __call__ (PyObject.java:438)
	at org.python.core.PyMethod.instancemethod ___call__ (PyMethod.java:237)
	at org.python.core.PyMethod. __call__ (PyMethod.java:228)
	at org.python.pycode._pyx5907.runAction$1(<function:runAction>:8)
	at org.python.pycode._pyx5907.call_function(<function:runAction>)
	at org.python.core.PyTableCode.call(PyTableCode.java:171)
	at org.python.core.PyBaseCode.call(PyBaseCode.java:308)
	at org.python.core.PyFunction.function ___call__ (PyFunction.java:471)
	at org.python.core.PyFunction. __call__ (PyFunction.java:466)
	at org.python.core.PyFunction. __call__ (PyFunction.java:461)
	at com.inductiveautomation.ignition.common.script.ScriptManager.runFunction(ScriptManager.java:821)
	at com.inductiveautomation.ignition.common.script.ScriptManager.runFunction(ScriptManager.java:805)
	at com.inductiveautomation.ignition.gateway.project.ProjectScriptLifecycle$TrackingProjectScriptManager.runFunction(ProjectScriptLifecycle.java:687)
	at com.inductiveautomation.ignition.common.script.ScriptManager$ScriptFunctionImpl.invoke(ScriptManager.java:964)
	at com.inductiveautomation.ignition.gateway.project.ProjectScriptLifecycle$AutoRecompilingScriptFunction.invoke(ProjectScriptLifecycle.java:752)
	at com.inductiveautomation.perspective.gateway.script.ScriptFunctionHelper.invoke(ScriptFunctionHelper.java:106)
	at com.inductiveautomation.perspective.gateway.action.ScriptAction.runAction(ScriptAction.java:71)
	at com.inductiveautomation.perspective.gateway.model.ActionCollection$ActionSequence$ExecuteActionsTask.lambda$call$0(ActionCollection.java:263)
	at com.inductiveautomation.perspective.gateway.api.LoggingContext.mdc(LoggingContext.java:54)
	at com.inductiveautomation.perspective.gateway.model.ActionCollection$ActionSequence$ExecuteActionsTask.call(ActionCollection.java:252)
	at com.inductiveautomation.perspective.gateway.model.ActionCollection$ActionSequence$ExecuteActionsTask.call(ActionCollection.java:221)
	at com.inductiveautomation.perspective.gateway.threading.BlockingTaskQueue$TaskWrapper.run(BlockingTaskQueue.java:154)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
	at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
	at java.base/java.lang.Thread.run(Unknown Source)
Caused by: com.inductiveautomation.ignition.common.GenericTransferrableException: Traceback (most recent call last):
  File "<function:runAction>", line 3, in runAction
	at com.inductiveautomation.ignition.common.script.builtin.http.JythonHttpClient.send(JythonHttpClient.java:94)
	at com.inductiveautomation.ignition.common.script.builtin.http.JythonHttpClient.post(JythonHttpClient.java:308)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
java.io.IOException: java.io.IOException: Unable to POST https://10.100.3.31:443/api/api-token-auth/

	... 30 common frames omitted
Caused by: com.inductiveautomation.ignition.common.GenericTransferrableException: Unable to POST https://10.100.3.31:443/api/api-token-auth/
	at com.inductiveautomation.ignition.common.script.builtin.http.JythonHttpClient.send(JythonHttpClient.java:94)
	at com.inductiveautomation.ignition.common.script.builtin.http.JythonHttpClient.post(JythonHttpClient.java:308)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
	at org.python.core.PyReflectedFunction. __call__ (PyReflectedFunction.java:188)
	... 27 common frames omitted
Caused by: com.inductiveautomation.ignition.common.GenericTransferrableException: No subject alternative names present
	at java.net.http/jdk.internal.net.http.HttpClientImpl.send(Unknown Source)
	at java.net.http/jdk.internal.net.http.HttpClientFacade.send(Unknown Source)
	at com.inductiveautomation.ignition.common.script.builtin.http.JythonHttpClient.send(JythonHttpClient.java:92)
	... 33 common frames omitted
Caused by: com.inductiveautomation.ignition.common.GenericTransferrableException: No subject alternative names present
	at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
	at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
	at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
	at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(Unknown Source)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(Unknown Source)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(Unknown Source)
	at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(Unknown Source)
	at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(Unknown Source)
	at java.base/java.security.AccessController.doPrivileged(Native Method)
	at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(Unknown Source)
	at java.base/java.util.ArrayList.forEach(Unknown Source)
	at java.net.http/jdk.internal.net.http.common.SSLFlowDelegate.lambda$executeTasks$3(Unknown Source)
	at java.net.http/jdk.internal.net.http.HttpClientImpl$DelegatingExecutor.execute(Unknown Source)
	at java.net.http/jdk.internal.net.http.common.SSLFlowDelegate.executeTasks(Unknown Source)
	at java.net.http/jdk.internal.net.http.common.SSLFlowDelegate.doHandshake(Unknown Source)
	at java.net.http/jdk.internal.net.http.common.SSLFlowDelegate$Reader.processData(Unknown Source)
	at java.net.http/jdk.internal.net.http.common.SSLFlowDelegate$Reader$ReaderDownstreamPusher.run(Unknown Source)
	at java.net.http/jdk.internal.net.http.common.SequentialScheduler$SynchronizedRestartableTask.run(Unknown Source)
	at java.net.http/jdk.internal.net.http.common.SequentialScheduler$CompleteRestartableTask.run(Unknown Source)
	at java.net.http/jdk.internal.net.http.common.SequentialScheduler$TryEndDeferredCompleter.complete(Unknown Source)
	at java.net.http/jdk.internal.net.http.common.SequentialScheduler$CompleteRestartableTask.run(Unknown Source)
	at java.net.http/jdk.internal.net.http.common.SequentialScheduler$SchedulableTask.run(Unknown Source)
	... 3 common frames omitted
Caused by: com.inductiveautomation.ignition.common.GenericTransferrableException: No subject alternative names present
	at java.base/sun.security.util.HostnameChecker.matchIP(Unknown Source)
	at java.base/sun.security.util.HostnameChecker.match(Unknown Source)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
	at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(Unknown Source)
	at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unknown Source)
	... 24 common frames omitted

```

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [January 21, 2021, 4:59pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/2 "2021-01-21T16:59:21Z")

</div>

Can you `print client`? The `toString()` may be helpful. The stack trace looks like it’s not choosing the alternative, no-op trust manager that it should be.

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [January 21, 2021, 5:16pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/3 "2021-01-21T17:16:04Z")

</div>

Client print:

```auto
18:16:33.358 [Browser Thread: 57869] INFO Perspective.Designer.Workspace - client.toString()=<JythonHttpClient@198812531 timeout=10000, bypass_cert_validation=True, has_credentials=True, proxy=None, cookie_policy='ACCEPT_ORIGINAL_SERVER', redirect_policy='NEVER'>

```

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [January 21, 2021, 5:21pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/4 "2021-01-21T17:21:21Z")

</div>

@paul-griffith I don’t think these no-op trust manager implementations we use excuse an invalid certificate - they just skip the part where it is verified that a path from the cert to a Trust Anchor can be constructed.

@mazeyrat you probably need to get a valid SSL certificate in place, even if it’s self-signed - one that has SAN entries present.

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [January 21, 2021, 5:24pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/5 "2021-01-21T17:24:27Z")

</div>

I will ask to the webserver provider if he can check its SSL certificate.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [January 21, 2021, 5:26pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/6 "2021-01-21T17:26:24Z")

</div>

You are accessing it via 10.100.3.31, therefore it must contain an IP address entry matching that in the SAN extension. You can grab the certificate and verify this yourself.

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [January 21, 2021, 5:28pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/7 "2021-01-21T17:28:09Z")

</div>

how do I can grab the certificate and verify myself ?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [January 21, 2021, 5:29pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/8 "2021-01-21T17:29:19Z")

</div>

In Chrome you can just put the URL into the browser and then click on the padlock or whatever in the URL bar to view/download the certificate… somewhere.

There’s probably better ways via command line too.

edit: `openssl s_client -connect {HOSTNAME}:{PORT} -showcerts`

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [January 21, 2021, 5:33pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/9 "2021-01-21T17:33:43Z")

</div>

the certificate seem to be not valid. End date 29 Spetembre 2020 !

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/0/50a4df49dfd5dfc98b6ce94a80ff28a94505acb2.png)

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [January 22, 2021, 3:50pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/10 "2021-01-22T15:50:41Z")

</div>

@Kevin.Herron, @paul-griffith

Is there any way to ignore **SSL certificate verification** in httpPost / httpClient from ignition ?

For example in **Postman** , it works with “SSL certificate versification=OFF”  
and with **curl -k** :

```auto
curl -X POST -d '{"username": "admin", "password": "admin"}' -H "Content-Type: application/json" -k "https://10.100.3.31:443/api/api-token-auth/"

```

I tried to add the certificate (\*.p7b) exported from chrome in  
**C:\Program Files\Inductive Automation\Ignition\data\certificates\supplemental**  
restarted the gateway, but I have still this error.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/d/2ddf9c39b33edda383fd2e76d958176d7b28cdaa.png)

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [January 22, 2021, 8:33pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/11 "2021-01-22T20:33:53Z")

</div>

@paul-griffith,  
Perhaps something like this could be added to httpClient in case of **bypass\_cert\_validation=True**

> <https://stackoverflow.com/questions/52988677/allow-insecure-https-connection-for-java-jdk-11-httpclient/52995420#52995420>

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [January 22, 2021, 9:49pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/12 "2021-01-22T21:49:38Z")

</div>

Setting that property would be ‘global’, though - there’s no great way to set it for a single http client instance.

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [January 23, 2021, 7:16pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/13 "2021-01-23T19:16:12Z")

</div>

Perhaps a parameter to accep some untrusted certificate for HTTPS connection could be possible with httpClient, it would be usefull for dev/test environnement.

> <https://stackoverflow.com/questions/1201048/allowing-java-to-use-an-untrusted-certificate-for-ssl-https-connection/1201102#1201102>

> **[Allow insecure SSL in Java 11 HttpClient](https://www.javacodemonk.com/allow-insecure-ssl-in-java-11-httpclient-6e677c76)**
>
> We will learn how to allow insecure SSL connections (expired certificate, self-signed certificates) in Java 11 HttpClient.

For test purpose only, I ended with temporary adding in **ignition.conf** :

```auto
-Djdk.internal.httpclient.disableHostnameVerification

```

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [January 25, 2021, 4:55pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/14 "2021-01-25T16:55:23Z")

</div>

That ‘trust all’ cert manager approach is exactly what the code currently does. It’s just that your particular cert is not just self-signed, but entirely invalid, which apparently Java still balks at (without the system property). It’s relatively unlikely we’ll change anything around that - you _can_ work around it yourself, but globally setting internal http client parameters seems like a bad idea. It’s possible some future version of Java will enhance the HTTP client to allow a more first-class bypass mechanism, in which case we could add it to the `httpClient()` function.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [February 8, 2021, 5:55pm UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/15 "2021-02-08T17:55:00Z")

</div>

Another developer came up with a different approach that should work here - the latest 8.1.3 nightly enhances the `bypass_cert_validation` flag to allow totally invalid certs.

---

<div class="post-metadata">

**Author:** ![Brian\_Ellsworth](https://avatars.discourse-cdn.com/v4/letter/b/258eb7/32.png) [@Brian\_Ellsworth](https://forum.inductiveautomation.com/u/Brian_Ellsworth)\
**Post date:** [April 6, 2022, 1:04am UTC](https://forum.inductiveautomation.com/t/system-net-httpclient-post-return-exception-no-subject-alternative-names-present/42478/16 "2022-04-06T01:04:30Z")

</div>

Hi All,

Came across this post and wanted to let you know I had the exact same error when trying to access developer when trying to use a self-signed cert. What I did was fill out the optional field at the bottom of the cert application for additional IP’s to just include one additional IP. This worked and allowed me to access developer