Retina is complaining that the SSL certificate running on my Tomcat server does not return the fully qualified domain name (fqdn) but rather the IP. I connected to my Tomcat server on port 443 using the command: openssl s_client -connect <ip>:443 and it shows me the CN=mymachine.mydomain.net. Nowhere do I see the IP address being displayed. However, Retina says the Found Value is an IP address.

I followed the directions here at Bill Comer's Blog to create a self-signed certificate. I don't see how the Found Value can be the IP address of the Target Host Name rather than the fqdn.

What command is Retina sending to determine this? What else am I doing wrong?

  • 1
    Do you keep your CSRs? – Simon Catlin Jul 17 '13 at 20:40
  • @Simon: Yes, I have them – Brian Jul 17 '13 at 20:41
  • I did openssl req -in <csr_file> -noout -text and it shows the CN=<myhostname> – Brian Jul 17 '13 at 20:43
  • @0A0D Does the certificate have subject alternative names? – Shane Madden Jul 18 '13 at 6:03
  • @ShaneMadden: Nope. – Brian Jul 18 '13 at 12:12

System Administrator had to add machines to DNS server and problem went away. This problem did not get noticed even by doing a nslookup from the Retina machine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.