Error on client request :Exceptionjavax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 172.19.91.103 found

[Pooja27-proj]

Hello,
I am using ejbca 8.3.1 version docker image and docker env :-
TLS_SETUP_ENABLED=simple
- EJBCA_CA_NAME=ManagementCA
- EJBCA_SUPERADMIN_CN=SuperAdmin
- EJBCA_SUPERADMIN_DN="CN=SuperAdmin,O=Capgemini,C=India"
and created one alias on server side.
I am trying to send request to ejbca ,URL ("https://172.19.91.103:443/ejbca/publicweb/cmp/cmpv2";) through java program,
CertificateRequestMessageBuilder msgbuilder = new CertificateRequestMessageBuilder(certReqId);
X500Name issuerDN = new X500Name("CN=CATesting");
X500Name subjectDN = new X500Name("CN=CATesting");
msgbuilder.setIssuer(issuerDN);
msgbuilder.setSubject(subjectDN);
final byte[] bytes = keyPair.getPublic().getEncoded();
final ByteArrayInputStream bIn = new ByteArrayInputStream(bytes);
try (ASN1InputStream dIn = new ASN1InputStream(bIn)) {
final SubjectPublicKeyInfo keyInfo = new SubjectPublicKeyInfo((ASN1Sequence) dIn.readObject());
msgbuilder.setPublicKey(keyInfo);
}
GeneralName sender = new GeneralName(subjectDN);
msgbuilder.setAuthInfoSender(sender);
Security.addProvider(new BouncyCastleProvider());
Provider prov = Security.getProvider("BC");
ContentSigner popsigner = new JcaContentSignerBuilder("SHA256withRSA").setProvider(prov)
.build(keyPair.getPrivate());
msgbuilder.setProofOfPossessionSigningKeySigner(popsigner);
CertificateRequestMessage msg = msgbuilder.build();
GeneralName recipient = new GeneralName(issuerDN);
ProtectedPKIMessageBuilder pbuilder = new ProtectedPKIMessageBuilder(sender, recipient);
pbuilder.setMessageTime(new Date());
pbuilder.setSenderNonce(senderNonce);
pbuilder.setTransactionID(transactionId);
CertReqMessages msgs = new CertReqMessages(
msg.toASN1Structure());
PKIBody pkibody = new PKIBody(PKIBody.TYPE_INIT_REQ, msgs);
pbuilder.setBody(pkibody);
ContentSigner msgsigner = new JcaContentSignerBuilder("SHA256withRSA").setProvider(prov)
.build(keyPair.getPrivate());
ProtectedPKIMessage message = pbuilder.build(msgsigner);

        PKIMessage pkiMessage = message.toASN1Structure();
        System.out.println("PKI Message: " + pkiMessage.toString());
        byte[] respBytes = sendCmpHttp(pkiMessage.getEncoded());

But facing issue :Exceptionjavax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 172.19.91.103 found
Please help me here ,How i can create client certificate.

[primetomas]

This is a TLS error due to the TLS certificate issued (by default) when using TLS setup simple. You should look what the TLS certificate have as hostname and you need to use that.
Or, better, since CMP does not need to be sent in a TLS tunnel, you can use plain http to send CMP messages.

[Pooja27-proj]

what configuration we need to do for http to send cmp message?

[primetomas]

That is in your program that sends the CMP message.

[Pooja27-proj]

any link of code in java to create Cert Request (2) for pre-registered client?

[primetomas]

See some java code in the documentation.
https://docs.keyfactor.com/ejbca/latest/cmp-client-support

It is not updated regularly, so this code may need to be modified for changes to the BC API. You can find test code among the EJBCA tests as well. https://github.com/Keyfactor/ejbca-ce/tree/main/modules/systemtests/src-test/org/ejbca/core/protocol/cmp

[Pooja27-proj]

@primetomas thankyou so much for your valuable comments,i need one more help that can i create same CSR request on GO in cmpv2 protocol ,any reference api or library available to work on GO

[primetomas]

You can try looking at the EJBCA Go client. https://github.com/Keyfactor/ejbca-go-client-sdk

[Pooja27-proj]

I could not see version V2 api or code to create/generate certificate.

[primetomas]

You're right. That Go SDK is for using the REST API, not CMP. I thought you may find sample code there to create a CSR or similar. I have not personally used any Go code for CMP requests.