If the directory/file paths specified in this guide do not exist in your WSO2 product, see Directory Structure of WSO2 Products to locate the paths applicable to your product.
Administration Guide 4.4.x
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 33 Next »

The contents of this page are currently under review!

The possibility to configure hostname verification is available for WSO2 products from Carbon 4.4.6 onwards. If hostname verification is disabled for your product, the hostnames (that are accessed by a particular client) will not be verified against the hostname specified in the product's SSL certificate. If hostname verification enabled, you will be able to configure how hostnames are filtered during the verification process.

See the following topics for details:

Important!

Be sure to enable hostname verification for your production environment. This is necessary to avoid security issues in production. See the full list of security recommendations for production environments.

Configuring hostname verification (Carbon 4.4.6 to Carbon 4.4.16)

If you are using a wso2 product that is based on a Carbon version between 4.4.6 and 4.4.16,  hostname verification disabled by default. This hostname verification setting is disabled using the org.wso2.ignoreHostnameVerification property in the <PRODUCT_HOME>/bin/wso2server.sh file as shown below.

-Dorg.wso2.ignoreHostnameVerification=true

Configuring hostname verification (Carbon 4.4.17 onwards)

If you are using a wso2 product that is based on Carbon 4.4.17 or a later version, hostname verification is enabled by default.

Additionally, you can use the httpclient.hostnameVerifier property for the purpose of configuring the default hostname verification setting. You can add this property to the product's startup script (wso2server.sh for Linux and wso2server.bat for Windows), which is stored in the <PRODUCT_HOME>/bin directory and specify a value as shown below. The property will be effective during server startup.

httpclient.hostnameVerifier=<property_value>

The values you can use with this property are explained below. If none of these values are specified, the default mode will be effective:

Note that these values will behave the same as synapse hostname verification options.

  • Strict: When this mode is enabled, hostnames will be strictly verified against the hostname specified in the product's SSL certificate. For example, if "*.foo.com" is specified as the hostname in the certificate, only the hostnames at the same level will be authorized by the server. That is, subdomains such as "a.b.foo.com" will not be authorized.

  • AllowAll: This option turns off hostname verification for the server. Note that this is not recommended in a production setup and should only be used for demonstrations and testing.

  • DefaultAndLocalhost: This option works the same as the default mode, except that the following hostnames will not be verified against the hostname in the certificate:  "localhost", "localhost.localdomain", "127.0.0.1", "::1". That is, these hostnames will be allowed regardless of the server's certificate.


  • No labels