Hi Bartek,

Can you please review following SA on PDN?

https://pdn.pega.com/support-articles/sni-validation-issues-sslprotocolexception

Hope this helps you in configuring SNI

Hi Bartlomiej ,

I'm pretty sure that the SSL Handshake is done at the JVM SSL Iimplemenation layer; something that PRPC (or any Java Program for that matter) is not really aware of.

The reason I'm reasonably confident about this, is that the following standalone Java can demonstrate the SNI mechanism in play:

// System.setProperty("jsse.enableSNIExtension", "false");
URL url== new URL('https://<SNI-ENABLED-ENDPOINT>");
HttpsURLConnection conn= (HttpsURLConnection) url.openConnection();

Later version of the JVM (7.x - I can't remember the exact version: I think it is 1.7.0.67 - but check me on that) will default the JVM System Property 'jsee.enableSNIExtension' to 'true'; and this will result in an error if the endpoint doesn't support the SNI extension.

So for your case: where you say your endpoint already support 'SNI' - you probably want to re-test using the laster version of the JVM; or you might be able to set the property to 'true' on an earlier version.

Hope this helps,

John

I presume your SOAP connection is over HTTP.

Please check your JVM version used support SNI.

For instance, Oracle/Sun JVM should send the SNI from version 7. Look at article below which indirectly tells it:

Bug ID: JDK-7127374 JSSE creates SSLProtocolException on (common) warning: unrecognized_name for SNI

In SUN jvm version 7, this is turned on by default unless it is turned off by using the following setting:

-Djsse.enableSNIExtension=false