SOAP Call from external Web server

[ignatius_dilip]

Hi Team,

For one of our projects, we are using the SOAP call to Adobe campaign V8 from the client's PROD web server. During the API call this is the error log generated in the web server.

Error: Hostname/IP does not match certificate's altnames: Host: https. is not in the cert's altnames: DNS:*.campaign.adobe.com)

However, there is no error while making the call from DEV web server.

Could you pls let me know the root cause and what solution need to be done from client's end or Adobe end?

[SushantTrimukheD]

Hi @ignatius_dilip,

The error suggests that the SOAP client on the PROD web server is attempting to connect to a hostname (in this case, "https", which is unusual and likely a misconfiguration) that is not included in the SSL certificate's Subject Alternative Names (SANs). The certificate presented by the Adobe Campaign server is valid for domains matching *.campaign.adobe.com (e.g., prod.campaign.adobe.com), but maybe the client is using an invalid or incorrect hostname, leading to the mismatch.

The PROD server's SOAP client is performing strict SSL verification, which checks if the hostname in the request matches the certificate's SANs or Common Name (CN). The DEV server may have less strict settings (e.g., SSL verification disabled or a different endpoint configuration), which is why it works there.

Thanks

Sushant Trimukhe

[_Manoj_Kumar_ · Accepted solution]

Hello @ignatius_dilip  The fix would be to disable the SSL verification in external server. If they are using CURL or similar way to call API then disable verify -> false and ssl ->false

[ignatius_dilip]

Hi @_Manoj_Kumar_ : Thanks for the solution. I will ask the client to disable the SSL verification in the web server

[ignatius_dilip]

Hi @_Manoj_Kumar_  and @SushantTrimukheD : While checking with client to disable the SSL verification, they are scared of breaching the security policy set by their organisation's protocols. Could you pls provide another solution/workaround without breaching their client's security policy? 

Thanks for your support

[_Manoj_Kumar_]

Hello @ignatius_dilip  I am only aware of this workaround. I believe the SSL is a wildcard SSL and used by multiple domains for tracking and images and will not have a same host name for verification.