Added test to verify that strict mode throws exception with no trust store

Author: chernser

client-v2/src/main/java/com/clickhouse/client/api/internal/HttpAPIClientHelper.java

@@ -67,6 +67,7 @@
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SNIHostName;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLParameters;
 import javax.net.ssl.SSLSocket;
 import java.io.IOException;
@@ -894,6 +895,10 @@ public RuntimeException wrapException(String message, Exception cause, String qu
             return (RuntimeException) cause;
         }
 
+        if (cause instanceof SSLException) {
+            return new ClickHouseException("SSL Problem", cause, queryId);
+        }
+
         if (cause instanceof ConnectionRequestTimeoutException ||
                 cause instanceof NoHttpResponseException ||
                 cause instanceof ConnectTimeoutException ||

client-v2/src/test/java/com/clickhouse/client/HttpTransportTests.java

@@ -1,12 +1,14 @@
 package com.clickhouse.client;
 
+import com.clickhouse.client.api.ClickHouseException;
 import com.clickhouse.client.api.Client;
 import com.clickhouse.client.api.ClientConfigProperties;
 import com.clickhouse.client.api.ClientException;
 import com.clickhouse.client.api.ClientFaultCause;
 import com.clickhouse.client.api.ClientMisconfigurationException;
 import com.clickhouse.client.api.ConnectionInitiationException;
 import com.clickhouse.client.api.ConnectionReuseStrategy;
+import com.clickhouse.client.api.DataTransferException;
 import com.clickhouse.client.api.ServerException;
 import com.clickhouse.client.api.Session;
 import com.clickhouse.client.api.command.CommandResponse;
@@ -59,6 +61,7 @@
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
 
+import javax.net.ssl.SSLHandshakeException;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.StringWriter;
@@ -437,6 +440,18 @@ public void testSSLModeStrictWithTrustStoreAndCaCertificate() {
         }
 
         ClickHouseNode secureServer = getSecureServer(ClickHouseProtocol.HTTP);
+        // A trust store and a CA certificate cannot both take effect: the trust store is used and the
+        // CA certificate is ignored (a warning is logged). The connection still succeeds via the trust store.
+        try (Client client = new Client.Builder()
+                .addEndpoint("https://localhost:" + secureServer.getPort())
+                .setUsername("default")
+                .setPassword(ClickHouseServerForTest.getPassword())
+                .build()) {
+            ClientException ex = Assert.expectThrows(ClientException.class, () -> client.queryAll("SELECT timezone()"));
+
+            Assert.assertTrue(ex.getCause() instanceof ClickHouseException);
+            Assert.assertTrue(ex.getCause().getMessage().startsWith("SSL Problem"));
+        }
 
         // A trust store and a CA certificate cannot both take effect: the trust store is used and the
         // CA certificate is ignored (a warning is logged). The connection still succeeds via the trust store.