Reject non-SSLContext ssl_context value at point of use in createHttpClient

Per @chernser review: when the 'ssl_context' configuration value is present but
not a javax.net.ssl.SSLContext instance, HttpAPIClientHelper.createHttpClient now
throws ClientMisconfigurationException instead of silently falling back to building
a context from trust/key material. A null value still builds from material and a
real SSLContext is still used as-is.

Implements: #2909

Author: polyglotAI-bot

client-v2/src/main/java/com/clickhouse/client/api/internal/HttpAPIClientHelper.java

@@ -285,9 +285,15 @@ public CloseableHttpClient createHttpClient(boolean initSslContext, Map<String,
         SSLContext sslContext = null;
         if (initSslContext) {
             Object customSSLContext = configuration.get(ClientConfigProperties.SSL_CONTEXT.getKey());
-            sslContext = customSSLContext instanceof SSLContext
-                    ? (SSLContext) customSSLContext
-                    : createSSLContext(configuration);
+            if (customSSLContext == null) {
+                sslContext = createSSLContext(configuration);
+            } else if (customSSLContext instanceof SSLContext) {
+                sslContext = (SSLContext) customSSLContext;
+            } else {
+                throw new ClientMisconfigurationException("'" + ClientConfigProperties.SSL_CONTEXT.getKey()
+                        + "' must be a javax.net.ssl.SSLContext instance but was "
+                        + customSSLContext.getClass().getName() + "; supply it via Client.Builder.setSSLContext(...)");
+            }
         }
         LayeredConnectionSocketFactory sslConnectionSocketFactory;
         if (sslContext != null) {

client-v2/src/test/java/com/clickhouse/client/api/ClientBuilderTest.java

@@ -198,6 +198,23 @@ public void testCreateSSLContextIgnoresCustomContext() throws Exception {
         }
     }
 
+    @Test
+    public void testCreateHttpClientRejectsNonSSLContextValue() throws Exception {
+        try (Client client = new Client.Builder()
+                .addEndpoint("https://localhost:8443")
+                .setUsername("default")
+                .setPassword("")
+                .build()) {
+            HttpAPIClientHelper helper = extractHttpClientHelper(client);
+            Map<String, Object> configWithBadContext = new HashMap<>(extractConfiguration(client));
+            configWithBadContext.put(ClientConfigProperties.SSL_CONTEXT.getKey(), "not-a-context");
+            // A non-SSLContext value under 'ssl_context' is a misconfiguration; createHttpClient must
+            // reject it instead of silently building a context from trust/key material.
+            Assert.expectThrows(ClientMisconfigurationException.class,
+                    () -> helper.createHttpClient(true, configWithBadContext));
+        }
+    }
+
     private static HttpAPIClientHelper extractHttpClientHelper(Client client) throws Exception {
         Field helperField = Client.class.getDeclaredField("httpClientHelper");
         helperField.setAccessible(true);