From version 1.0.24, when performing HTTPS endpoint identification, BCJSSE no longer

falls back to matching the CN of the certificate's subject name when the certificate

does not carry a subject alternative name of the appropriate type. RFC 9525 (which

obsoletes RFC 6125) deprecates the use of the CN for server identity, and the CA/Browser

Forum Baseline Requirements have long required publicly-trusted server certificates to

carry their DNS names in the subjectAltName extension. By default a server certificate

now only satisfies endpoint identification if it contains a matching subjectAltName

dNSName entry (or, where the peer was addressed by an IP literal, a matching iPAddress

entry). For deployments that still need to accept legacy certificates identifying the

server only via the CN, the previous behaviour can be restored by setting the

system/security property "org.bouncycastle.jsse.hostname_check_cn_fallback" to "true".