Question

I am trying to access my web application protected by SSL from an Android 2.3.4 using the built-in browser.

The server certificate is a self-signed certificate I created using MAKECERT and installed on the server.
When I try to access the page, I get an error message from the browser stating The name of the site does not match name on the certificate.

I have verified and the server address is exactly maching the Common Name of my certificate (it is actually just an IP address).

The message does not pop up when I try to access, on the Android device, other websites secured with not self signed certificates.

If I access the same page using IE or Chrome on a desktop – apart for the signing authority message – I get no warnings and, once I have installed the certificate in the Trusted Root CA, the certificate is smoothly accepted by the browser.

Should I take it that the message is actually a rejection of self signed certificate by Android?

I am a bit puzzled at this.

I tried to install the certificate in the Credential Storage but that does not improve the situation. and now I have no clue what I might try next.

Questions are: Is there any particular thing I should follow creating a self-signed certificate acceptable for Android? has anyone managed to get the self-signed certs accepted by Android without this warning?

What else could I try?

-UPDATE-
Bruno’s reply steered me in the right direction, so I managed to do one step forward: I remade the certificate adding SAN (had to abandon MAKECERT for OpenSSL, following there instructions from Andy Arismendi).

Now the message has gone but I am blocked in the ‘certification autority not trusted’ issue already discussed in this SO post, so I am still working to find a final solution to my issue – not having any warning popping up on the Android browser.

Answer 1

I have verified and the server address is exactly maching the Common
Name of my certificate (it is actually just an IP address).

Android’s host name verifier is more strictly compliant with RFC 2818 than some browsers. According to the specification, if an IP address is used, it must be in a Subject Alternative Name entry of IP address type: not on a SAN entry of DNS type or in the CN:

If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common
Name field in the Subject field of the certificate MUST be used.
Although the use of the Common Name is existing practice, it is
deprecated and Certification Authorities are encouraged to use the
dNSName instead.

[…]

In some cases, the URI is specified as an IP address rather than a hostname. In this case, the iPAddress subjectAltName must be present
in the certificate and must exactly match the IP in the URI.

The easiest would be to use a host name. (Using IP addresses in certificates is never really practical.) Alternatively, generate a certificate with a SAN IP address entry. (You may be interested in this.)