title: Why does android get the wrong ssl certificate? (two domains, one server)
body: <p>I have two domains: <code>foo.net</code> and <code>bar.com</code>. They both have SSL certificates, and they work well in all desktop and mobile browsers. They are hosted on the same server configured with nginx.</p>
  
  <p>However, when I make a request to a domain from within a native android app, it somehow gets the certificate from the wrong domain! This results in an IO Exception:</p>
  
  <pre><code>request = new HttpPost("https://foo.net/api/v1/baz");
  request.setHeader("Authorization", "user:pass");
  response = httpClient.execute(request);
  </code></pre>
  
  <p>...</p>
  
  <blockquote>
    <p><code>javax.net.ssl.SSLException: hostname in certificate didn't match: &lt;foo.net&gt; != &lt;bar.com&gt; OR &lt;bar.com&gt; OR &lt;www.bar.com&gt;</code></p>
  </blockquote>
  
  <p>What would cause android/java to try using the certificate from <code>bar.com</code> when every other measure seems to indicate that the server is correctly configured? Nothing appears in the nginx access or error log. There is no mention of <code>bar.com</code> anywhere in my android project.</p>
  
  <p>Edit: I'm not sure why, but it appears that the server is using the certificate for <code>bar.com</code> for the server IP <code>https://198.245.xx.xxx</code> </p>