📌WebSphere Outbound SSL & SNI – Troubleshooting Guide

• ERROR : javax.net.ssl.SSLHandshakeException: No name matching found.
• This guide helps you diagnose and fix WebSphere outbound HTTPS failures when the target requires SNI.
• You'll get exact OpenSSL checks, JVM flags, and a support matrix.

---

WebSphere Outbound SSL & SNI – Troubleshooting Guide

📑 Table of Contents

• What is SNI?
• Why SNI matters in WebSphere
• Common error patterns
• Confirming an SNI issue (OpenSSL)
• SNI support matrix (WebSphere/Java)
• How to enable SNI in WebSphere
• Best practices checklist
• FAQ (quick answers)

---

🔎 What is SNI?

• Server Name Indication (SNI) is a TLS extension
• Client includes the target hostname in the ClientHello message
• Allows servers to present the correct certificate when multiple virtual hosts share the same IP address

Without SNI you often receive a default certificate → CN/SAN mismatch → hostname validation fails even if the trust chain is fine.

🎯 Why SNI matters in WebSphere

• Outbound calls from WebSphere to cloud APIs, SaaS, and WAF/CDN fronted apps often terminate on shared VIPs
• Older or non-default Java settings may not send SNI (Server Name Indication).
• Without SNI, the remote server sends a default certificate.
• Your client fails with hostname mismatch error.

---

🚨 Common error patterns

javax.net.ssl.SSLHandshakeException: No name matching <api.company.com> found
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
PKIX path building failed: unable to find valid certification path to requested target
CWPKI0022E: SSL HANDSHAKE FAILURE
GSK_ERROR_BAD_CERT

---

🧪 Confirming an SNI issue (OpenSSL)

Compare results with and without SNI from the WebSphere host:

# Baseline ( May still send SNI implicitly)
openssl s_client -connect api.company.com:443 -showcerts

# Force SNI (ClientHello includes hostname)
openssl s_client -connect api.company.com:443 -servername api.company.com -showcerts

💬 Interpretation

If CN/SAN only matches when -servername is used, the endpoint requires SNI and your client must send it.

---

⚙️ How to enable SNI in WebSphere

Add this JVM system property to the server's Generic JVM Arguments:

-Djsse.enableSNIExtension=true

Console path: Servers → Server Types → WebSphere application servers → <server> → Java and Process Management → Process Definition → Java Virtual Machine → Generic JVM Arguments

Save, synchronize nodes, restart the JVM.

---

Optional: align TLS baseline

-Dhttps.protocols=TLSv1.2

---

🧭 Best practices checklist

• Verify CN/SAN with openssl s_client -servername before go-live or on UAT
• Standardize JVM args across environments; document SNI-dependent endpoints.
• Keep Java 8+; enforce TLS1.2+ to match common provider baselines.

---

❓ FAQ

Question	Answer
What is SNI and why does it matter?	SNI makes the server present the right certificate on shared IPs. Without it, you'll likely hit hostname mismatch in WebSphere even if trust is correct.
How do I enable SNI?	Add -Djsse.enableSNIExtension=true to Generic JVM Arguments, then save, sync, and restart.
Which versions support SNI?	WAS 8.5.5.x (Java 8) and WAS 9.x (Java 8/11) support SNI; WAS 7.x doesn't; WAS 8.0.x is partial/inconsistent.
How do I confirm an SNI issue?	Compare openssl s_client with/without -servername. If only the SNI run shows the correct CN/SAN, you need SNI.