topic Re: Splunk AppDynamics HTTP Error 400 Invalid SNI in Splunk AppDynamics

Splunk AppDynamics HTTP Error 400 Invalid SNI

Osama_Abbas1 — Fri, 14 Mar 2025 19:54:43 GMT

I am deploying an On-Premises AppDynamics demo for a customer version (25.1.1.10031) and it is running on HTTP (8090). However, when I try to open it https://<ip_addr>:8181, I get the attached error message.

SNI

The screenshot has appd not the IP address just to hide it

How do I bypass this error?

Re: AppDynamics HTTP Error 400 Invalid SNI

livehybrid — Tue, 11 Mar 2025 21:24:25 GMT

Hi @Osama_Abbas1

Have you configured a APPDYNAMICS_CONTROLLER_HOST_NAME variable when running AppD? If so, is this the IP or hostname for your install?

IP addresses cannot be used with SSL Certificate SNI, which explains the error, although I would have expected just a browser warning. This makes me wonder, are you connecting via a proxy from your client to your AppD server? This could be trying to generate an SSL cert for the connection and failing.

Worth reading:

https://docs.appdynamics.com/appd/23.x/latest/en/application-monitoring/install-app-server-agents/java-agent/administer-the-java-agent/java-agent-configuration-properties#:~:text=Required%3A%20Yes-,Controller%20Host,-The%20hostname%20or

https://docs.appdynamics.com/appd/onprem/23.x/23.6/en/secure-the-platform/controller-ssl-and-certificates

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: AppDynamics HTTP Error 400 Invalid SNI

Osama_Abbas1 — Tue, 11 Mar 2025 22:13:19 GMT

Hi @livehybrid,

Thanks a lot for your consideration.

I have been going through some jetty related posts (ring/ring-jetty-adapter/src/ring/adapter/jetty.clj at cefb95e698eeb8c58a082ddb2eec6fb9958506cb · ring-clojure/ring) in regard to this issue as it is the webserver running the controller. I found out that this is not a real issue with jetty, but rather, it is the default behavior. But luckily, it has a workaround.

After doing some research, below is the workaround:

This is not a permanent solution as the below changes will revert whenever jetty is upgraded, but it temporarily solves the problem.

$ cd /opt/appdynamics/platform/product/controller/appserver/jetty/etc $ cat jetty-ssl.xml <?xml version="1.0"?><!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_3.dtd">      <Configure id="Server" class="org.eclipse.jetty.server.Server">       <New id="sslHttpConfig" class="org.eclipse.jetty.server.HttpConfiguration"> <Arg><Ref refid="httpConfig"/></Arg> <Call name="addCustomizer"> <Arg> <New class="org.eclipse.jetty.server.SecureRequestCustomizer"> <Arg name="sniRequired" type="boolean"><Property name="jetty.ssl.sniRequired" default="false"/></Arg> <Arg name="sniHostCheck" type="boolean"><Property name="jetty.ssl.sniHostCheck" default="true"/></Arg> <Arg name="stsMaxAgeSeconds" type="int"><Property name="jetty.ssl.stsMaxAgeSeconds" default="-1"/></Arg> <Arg name="stsIncludeSubdomains" type="boolean"><Property name="jetty.ssl.stsIncludeSubdomains" default="false"/></Arg> </New> </Arg> </Call> </New> </Configure>

In the example above (jetty-ssl.xml file), the default value for jetty.ssl.sniHostCheck is "true". This value has to be changed to default="false" to bypass the sniHostCheck.

You may also need to change it in jetty-ssl.xml.j2 file

Then, you have to restart the Controller AppServer.

After the controller AppServer restart is completed, you will be able to access the AppDynamics Controller via https://<controller_ip_addr>:8181

Re: AppDynamics HTTP Error 400 Invalid SNI

livehybrid — Wed, 12 Mar 2025 07:55:48 GMT

Hey @Osama_Abbas1

Thanks for letting us know how you resolved it 🙂
Good luck with your future AppD work!

Will

Re: AppDynamics HTTP Error 400 Invalid SNI

Osama_Abbas1 — Wed, 12 Mar 2025 10:10:48 GMT

Hey @livehybrid ,

Thanks! I appreciate it. Wishing you the best too! 😊

Re: Splunk AppDynamics HTTP Error 400 Invalid SNI

Maciej_Popek — Wed, 22 Oct 2025 13:00:00 GMT

Recently I have created a community article regarding the SNI checks for each of the components in AppDynamics product - Controller, ES and EUM server. Please feel free to check it out, I have described exactly how SNI checks work, how to fix this issue permanently, and how to disable the SNI checks for each of the component of AppD:

https://community.splunk.com/t5/AppDynamics-Knowledge-Base/AppDynamics-Platform-Best-Practices-and-Guidance-for-SNI-Checks/ta-p/753919