Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Retina is complaining that the SSL certificate running on my Tomcat server does not return the fully qualified domain name (fqdn) but rather the IP. I connected to my Tomcat server on port 443 using the command: openssl s_client -connect <ip>:443 and it shows me the Nowhere do I see the IP address being displayed. However, Retina says the Found Value is an IP address.

I followed the directions here at Bill Comer's Blog to create a self-signed certificate. I don't see how the Found Value can be the IP address of the Target Host Name rather than the fqdn.

What command is Retina sending to determine this? What else am I doing wrong?

share|improve this question
Do you keep your CSRs? – Simon Catlin Jul 17 '13 at 20:40
@Simon: Yes, I have them – Brian Jul 17 '13 at 20:41
I did openssl req -in <csr_file> -noout -text and it shows the CN=<myhostname> – Brian Jul 17 '13 at 20:43
@0A0D Does the certificate have subject alternative names? – Shane Madden Jul 18 '13 at 6:03
@ShaneMadden: Nope. – Brian Jul 18 '13 at 12:12
up vote 0 down vote accepted

System Administrator had to add machines to DNS server and problem went away. This problem did not get noticed even by doing a nslookup from the Retina machine.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.