Getting SSLException : Unacceptable certificate from abc.example.com: application verification failure

[gokulkrishna-k]

when establishing a WebSocket connection to our server this exception occurs.
Unacceptable certificate from abc.example.com: application verification failure
The exception is captured by const Poco::Net::SSLException &e , kindly refer the code below

initialize() will be called before connect()

void WSSyncSocket::initialize() {
    std::string hostName = getServerHostName();
    int hostPort = getServerPort();

    lpHttpRequest = std::shared_ptr<HTTPRequest>(new HTTPRequest(
        Poco::Net::HTTPRequest::HTTP_GET, "/" + serverEndpointUrl, HTTPMessage::HTTP_1_1));

    Poco::Net::initializeSSL();
    _isSSLInitialized = true;

    ptrMyInvalidCertificateHandler = new Poco::Net::MyInvalidCertificateHandler(
        false, _isSystemMode, (WsLogger) ? WsLogger : nullptr);

    ptrHandler = ptrMyInvalidCertificateHandler;

    lpWssContext = (new Poco::Net::Context(Poco::Net::Context::TLS_CLIENT_USE, "", "", "",
                                           Poco::Net::Context::VERIFY_RELAXED, 9, true));
    lpWssContext->requireMinimumProtocol(Poco::Net::Context::PROTO_TLSV1_2);
    lpWssContext->setInvalidCertificateHandler(ptrMyInvalidCertificateHandler);

    if (!ptrHandler)
        Poco::Net::SSLManager::instance().initializeClient(0, ptrHandler, lpWssContext);

    lpClientSession = std::shared_ptr<HTTPClientSession>(
        (HTTPClientSession *)new HTTPSClientSession(hostName, hostPort, lpWssContext));
}

bool WSSyncSocket::connect() {
    bool connectResult = false;

    try {
        if ((lpHttpRequest != NULL) && (lpClientSession != NULL)) {
            if (WsLogger)
                WsLogger->log(CSLoggerUtils::CSLogger::LOG_INFO,
                              "Creating a websocket connection object");

            lpWebSocket = std::shared_ptr<WebSocket>(
                new WebSocket(*(lpClientSession.get()), *(lpHttpRequest.get()), (httpResponse)));

            if (lpWebSocket != NULL) {
                initSocketConfigurations();

                if (WsLogger)
                    WsLogger->log(CSLoggerUtils::CSLogger::LOG_INFO,
                                  "WebSocket Connection Successful");

                connectResult = true;
            } else {
                if (WsLogger)
                    WsLogger->log(CSLoggerUtils::CSLogger::LOG_INFO, "WebSocket Connection failed");
            }
        } else {
            if (WsLogger)
                WsLogger->log(CSLoggerUtils::CSLogger::LOG_ERROR,
                              "HTTPRequest and ClientSession parameters not initialized");
            setLastError(SOCKUTIL_ERROR_SOCKET_NOT_INITIALIZED);
        }
    } catch (WebSocketException &wsExcep) {
        if (WsLogger)
            WsLogger->log(CSLoggerUtils::CSLogger::LOG_ERROR, "Code : %d, WebSocketException - %s",
                          wsExcep.code(), wsExcep.message());
        setLastError(wsExcep.code(), (char *)wsExcep.what());
    } catch (const Poco::Net::SSLException &e) {
        std::string errorMessage = std::string((char *)e.what());

        if (WsLogger) {
            WsLogger->log(CSLoggerUtils::CSLogger::LOG_ERROR,
                          "SSLException Code : %d, Message : %s", e.code(), e.message());
        }

        setLastError(e.code(), (char *)errorMessage.c_str());
    } catch (std::exception &excep) {
        if (WsLogger)
            WsLogger->log(CSLoggerUtils::CSLogger::LOG_ERROR, "Exception - %s",
                          std::string(excep.what()));
        connectResult = false;
        setLastError(SOCKUTIL_STD_EXCEPTION, (char *)excep.what());
    } catch (...) {
        if (WsLogger) WsLogger->log(CSLoggerUtils::CSLogger::LOG_ERROR, "Exception - UNKNOWN");
        connectResult = false;
        setLastError(SOCKUTIL_STD_EXCEPTION, ("UNKNOWN_EXCEPTION"));
    }

    return connectResult;
}

I observed that this exception only occurs when the SSL cert received from the server contains different CN instead of the server endpoint I'm connecting to (in case Self Signed firewall certificates).

I printed the certificate , here is the sample as i cannot share the original certificate

Certificate Validation Success, Certificate Details: Subject: CN=*.xyz.com, Issued Name: C=GB,ST=Greater Manchester,L=Salford,O=Sectigo Limited,CN=Sectigo RSA Domain Validation Secure Server CA, Common Name: *.xyz.com, Serial Number: 90F3****DEE, Expires on: 2025-05-02 05:29:59, Signature Algorithm: sha256WithRSAEncryption

xyz.com is not the server I'm trying to connect to.

#1414 - this is similar to my issue but in my case I'm using WebSocket with HTTPClientSession

Thanks in advance for any suggestions.

[micheleselea]

try using Poco::Net::Context::VERIFY_NONE
because if you use VERIFY_RELAXED you need to create the Poco::Net::Context giving the correct caLocation file. For example you can use a .pem file from mozilla firefox you can find it online

[github-actions[bot]]

This issue is stale because it has been open for 365 days with no activity.

[matejk]

This is expected behavior, not a POCO bug.

What's happening:
You're behind a corporate firewall/proxy that performs SSL interception. The proxy intercepts your HTTPS connection and presents its own certificate (CN=*.xyz.com) instead of the actual server's certificate (abc.example.com). This is why the hostname doesn't match.

Why POCO rejects it:
Even with VERIFY_RELAXED, POCO performs "extended certificate verification" which checks if the certificate's Common Name (CN) or Subject Alternative Names (SAN) match the target hostname. This is enabled by default and is a security feature to prevent man-in-the-middle attacks.

Solution - disable extended verification:

lpWssContext = new Poco::Net::Context(Poco::Net::Context::TLS_CLIENT_USE, "", "", "",
                                      Poco::Net::Context::VERIFY_RELAXED, 9, true);
lpWssContext->enableExtendedCertificateVerification(false);  // Add this line

This keeps certificate chain validation (VERIFY_RELAXED) but disables hostname matching. This is appropriate for corporate proxy environments where hostname mismatch is expected.

Security note: Disabling extended verification means you won't be protected against hostname spoofing attacks. Only use this in controlled environments (like corporate networks with SSL inspection) where you trust the proxy.

Closing as this is a usage question, not a bug.

[matejk]

Converting this issue to a discussion as it's a usage question rather than a bug report.