No subject alternative DNS name matching Exception

Using Jenkins
1

Jenkins setup:
Jenkins 2.426.3
[Active DirectoryVersion2.35]
[LDAPVersion711.vb_d1a_491714dc]

Here is my Active Directory Configuration on Jenkins;

image
image1797×971 50.5 KB

LDAPS is working properly but I’m getting exceptions on jenkins.log. Here are the error lines;
java.security.cert.CertificateException: No subject alternative DNS name matching InterEXT.local found.
Caused: javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching InterEXT.local found.
Caused: javax.naming.CommunicationException: InterEXT.local:636 [Root exception is javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching InterEXT.local found.]
Caused: javax.naming.PartialResultException [Root exception is javax.naming.CommunicationException: InterEXT.local:636 [Root exception is javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching InterEXT.local found.]]
java.security.cert.CertificateException: No subject alternative DNS name matching InterEXT.local found.

My certificate does not include SAN field like InterEXT.local but I didn’t understand why plugin trying to match this address from bind dn?
My Domain name and controller does not have an info like InterEXT.local (with upper case EXT) I only have this config in bind dn. I’m confused.
I asked our active directory team to change SAN name but. I’m not sure that are we suppose to do that or is there any bug here?

2

First looking at the screenshot it seems you’re using the Active Directory plugin. Means the LDAP plugin is not used at all (you can uninstall it).
It works because you configured the TLS configuration with Insecure (Trust all certificates).
The problem is not related to the certificate of your Jenkins instance.
During the communication with AD, a site with name InterEXT.local is contacted (domain names are case insensitive) and this site is using a certificate that hasn’t this name in it’s subject alt names field.

1 Like
3

Thanks for the answer. Bu I didn’t understand why jenkins contacted with bind dn OUs not with domain controller url?

4

@mawinter69 do you have any idea? Our AD Team says it should use FQDN name of Domain Controller.

5

Sorry I’m not familiar with the internals of the AD plugin or the ldap protocol to give further assistance