title: https URL hostname not matching Common Name (CN) despite setting 'disableCNCheck' to true
body: <p>I managed to configure my CXF-based client properly so that it finds the correct SSL certificate for the server on which I am running a web service:</p>
  
  <pre><code>  &lt;http:conduit name="https://myserver/myws/register/soap?wsdl:{http://glob.reg.com/myws}.http-conduit"&gt;
  
      &lt;http:tlsClientParameters&gt;
        &lt;sec:keyManagers keyPassword="changeit"&gt;
          &lt;sec:keyStore type="JKS" password="changeit"
                    file="C:\Program Files (x86)\Java\jdk1.6.0_45\jre\lib\security\cacerts"/&gt; 
         &lt;/sec:keyManagers&gt;
        &lt;sec:trustManagers&gt;
          &lt;sec:keyStore type="JKS" password="changeit"
                    file="C:\Program Files (x86)\Java\jdk1.6.0_45\jre\lib\security\cacerts"/&gt; 
        &lt;/sec:trustManagers&gt;
        &lt;sec:cipherSuitesFilter&gt;
          &lt;!-- these filters ensure that a ciphersuite with
               export-suitable or null encryption is used,
               but exclude anonymous Diffie-Hellman key change as
               this is vulnerable to man-in-the-middle attacks --&gt;
          &lt;sec:include&gt;.*_EXPORT_.*&lt;/sec:include&gt;
          &lt;sec:include&gt;.*_EXPORT1024_.*&lt;/sec:include&gt;
          &lt;sec:include&gt;.*_WITH_DES_.*&lt;/sec:include&gt;
          &lt;sec:include&gt;.*_WITH_AES_.*&lt;/sec:include&gt;
          &lt;sec:include&gt;.*_WITH_NULL_.*&lt;/sec:include&gt;
          &lt;sec:exclude&gt;.*_DH_anon_.*&lt;/sec:exclude&gt;
        &lt;/sec:cipherSuitesFilter&gt;
      &lt;/http:tlsClientParameters&gt;
      &lt;http:authorization&gt;
        &lt;sec:UserName&gt;Betty&lt;/sec:UserName&gt;
        &lt;sec:Password&gt;password&lt;/sec:Password&gt;
      &lt;/http:authorization&gt;
      &lt;http:client AutoRedirect="true" Connection="Keep-Alive"/&gt;
  
    &lt;/http:conduit&gt;
  </code></pre>
  
  <p>But... because the certificate is for a subdomain name that's different than my server's machine (maps to the same IP address), I am getting the following error:</p>
  
  <pre><code>Caused by: java.io.IOException: The https URL hostname does not match the Common Name (CN) on the server certificate in the client's truststore.  Make sure serv
  er certificate is correct, or to disable this check (NOT recommended for production) set the CXF client TLS configuration property "disableCNCheck" to true.
          at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1234)
          at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.onFirstWrite(URLConnectionHTTPConduit.java:183)
          at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:47)
          at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69)
          at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1293)
          ... 18 more
  </code></pre>
  
  <p><strong>So...</strong> since this is a development/test system, I did just as the message proposed (set the CXF client TLS configuration property "disableCNCheck" to true):</p>
  
  <pre><code>&lt;http:tlsClientParameters disableCNCheck="true"&gt;
  </code></pre>
  
  <p><strong>Plus</strong>, I added the following code to my client's main class (per the suggestion <a href="https://stackoverflow.com/a/10296475">in this thread</a>):</p>
  
  <pre><code>  static {
      HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier()
      {
        @Override
        public boolean verify(String hostname, SSLSession session)
        {
          return true;
        }
  
      });    
    }
  </code></pre>
  
  <p><strong>But...</strong> I am still getting the same error:</p>
  
  <pre><code>Caused by: java.io.IOException: The https URL hostname does not match the Common Name (CN) on the server certificate in the client's truststore.  Make sure serv
  er certificate is correct, or to disable this check (NOT recommended for production) set the CXF client TLS configuration property "disableCNCheck" to true.
          at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1234)
          at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.onFirstWrite(URLConnectionHTTPConduit.java:183)
          at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:47)
          at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69)
          at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1293)
          ... 18 more
  </code></pre>
  
  <p>Any idea why?</p>
  
  <p>I mean, one of the above workarounds should have been enough to let the client ignore the certificate URL mismatch but, in my case, <em>neither works nor the combination thereof</em>.</p>
  
  <p>Why?</p>