Fixed problem of disabled verification

Author: chernser

client-v2/src/main/java/com/clickhouse/client/api/Client.java

@@ -1172,14 +1172,29 @@ public Client build() {
             // A trust store and a CA certificate are not rejected here: for VERIFY_CA/STRICT the trust
             // store takes precedence and the CA certificate is ignored with a warning (see createSSLContext).
 
-            // SSLMode.DISABLED does not turn encryption off - the endpoint scheme decides that. So it
-            // contradicts a secure (https) endpoint and must be rejected here, before the client is created.
-            if (SSLMode.DISABLED.name().equals(configuration.get(ClientConfigProperties.SSL_MODE.getKey()))) {
-                for (Endpoint endpoint : this.endpoints) {
-                    if ("https".equalsIgnoreCase(endpoint.getURI().getScheme())) {
-                        throw new ClientMisconfigurationException("SSL mode '" + SSLMode.DISABLED
-                                + "' cannot be used with a secure (https) endpoint. Use '" + SSLMode.TRUST
-                                + "' to trust all certificates or use plain HTTP.");
+            // Resolve ssl_mode case-insensitively and normalize it to the canonical enum name so that
+            // downstream parsing is consistent and an unknown value is reported as a misconfiguration
+            // here instead of failing later with a generic enum-parsing error.
+            String sslModeValue = configuration.get(ClientConfigProperties.SSL_MODE.getKey());
+            if (sslModeValue != null) {
+                SSLMode sslMode;
+                try {
+                    sslMode = SSLMode.fromValue(sslModeValue);
+                } catch (IllegalArgumentException e) {
+                    throw new ClientMisconfigurationException("Invalid value '" + sslModeValue + "' for '"
+                            + ClientConfigProperties.SSL_MODE.getKey() + "'", e);
+                }
+                configuration.put(ClientConfigProperties.SSL_MODE.getKey(), sslMode.name());
+
+                // SSLMode.DISABLED does not turn encryption off - the endpoint scheme decides that. So it
+                // contradicts a secure (https) endpoint and must be rejected here, before the client is created.
+                if (sslMode == SSLMode.DISABLED) {
+                    for (Endpoint endpoint : this.endpoints) {
+                        if ("https".equalsIgnoreCase(endpoint.getURI().getScheme())) {
+                            throw new ClientMisconfigurationException("SSL mode '" + SSLMode.DISABLED
+                                    + "' cannot be used with a secure (https) endpoint. Use '" + SSLMode.TRUST
+                                    + "' to trust all certificates or use plain HTTP.");
+                        }
                     }
                 }
             }

client-v2/src/test/java/com/clickhouse/client/api/ClientBuilderTest.java

@@ -1,5 +1,6 @@
 package com.clickhouse.client.api;
 
+import com.clickhouse.client.api.enums.SSLMode;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
@@ -22,6 +23,44 @@ public void testAddEndpointToleratesUnderscoreHostname() throws Exception {
         }
     }
 
+    @Test
+    public void testSslModeDisabledRejectedForHttpsRegardlessOfCase() {
+        // Value supplied as a raw (non-canonical case) string via setOption must still be recognized
+        // as DISABLED and rejected with ClientMisconfigurationException for an https endpoint.
+        for (String value : new String[] { "DISABLED", "disabled", "Disabled" }) {
+            Assert.expectThrows(ClientMisconfigurationException.class, () -> new Client.Builder()
+                    .addEndpoint("https://localhost:8443")
+                    .setUsername("default")
+                    .setPassword("")
+                    .setOption(ClientConfigProperties.SSL_MODE.getKey(), value)
+                    .build());
+        }
+    }
+
+    @Test
+    public void testSslModeInvalidValueRejected() {
+        Assert.expectThrows(ClientMisconfigurationException.class, () -> new Client.Builder()
+                .addEndpoint("https://localhost:8443")
+                .setUsername("default")
+                .setPassword("")
+                .setOption(ClientConfigProperties.SSL_MODE.getKey(), "insecure")
+                .build());
+    }
+
+    @Test
+    public void testSslModeNormalizedToCanonicalName() throws Exception {
+        // A non-canonical case value is accepted and normalized to the canonical enum name.
+        try (Client client = new Client.Builder()
+                .addEndpoint("http://localhost:8123")
+                .setUsername("default")
+                .setPassword("")
+                .setOption(ClientConfigProperties.SSL_MODE.getKey(), "trust")
+                .build()) {
+            Assert.assertEquals(client.getConfiguration().get(ClientConfigProperties.SSL_MODE.getKey()),
+                    SSLMode.TRUST.name());
+        }
+    }
+
     private static String extractFirstEndpointUri(Client client) throws Exception {
         Field endpointsField = Client.class.getDeclaredField("endpoints");
         endpointsField.setAccessible(true);

docs/features.md

@@ -42,7 +42,7 @@ Compatibility-sensitive traits:
 - `Geometry` handling is shape-sensitive: supported values are 1D through 4D Java arrays representing the nested geometry variants, and unsupported shapes or non-array values are rejected during serialization.
 - `Geometry` write inference is dimension-based rather than fully type-specific: point, ring/line string, polygon/multi-line string, and multi-polygon are selected from array depth, so writing `Geometry` cannot currently distinguish `Ring` from `LineString` or `Polygon` from `MultiLineString`.
 - Session precedence is part of the contract: client session defaults apply to each request, operation settings may override them, and only the client `session_id` is mutable at runtime while other client session properties remain fixed for the lifetime of the client.
-- SSL mode behavior is compatibility-sensitive: the default is `STRICT`. `ssl_mode` does not enable or disable encryption - the endpoint scheme decides that. `DISABLED` is only valid with a plain `http://` endpoint; combining it with an `https://` endpoint throws `ClientMisconfigurationException`. `TRUST` accepts any server certificate and skips hostname verification; a configured trust store or CA certificate has no effect in this mode and is ignored (a warning is logged), while a client certificate/key is still applied for mTLS. For `VERIFY_CA` and `STRICT`, a trust store and a CA certificate cannot both take effect: when both are configured the trust store is used and the CA certificate is ignored (a warning is logged). A trust store and a client certificate (`sslcert`) still cannot be configured together and throw `ClientMisconfigurationException`. When reading the `ssl_mode` value through the client configuration map, enum names are matched case-sensitively (`DISABLED`, `TRUST`, `VERIFY_CA`, `STRICT`).
+- SSL mode behavior is compatibility-sensitive: the default is `STRICT`. `ssl_mode` does not enable or disable encryption - the endpoint scheme decides that. `DISABLED` is only valid with a plain `http://` endpoint; combining it with an `https://` endpoint throws `ClientMisconfigurationException`. `TRUST` accepts any server certificate and skips hostname verification; a configured trust store or CA certificate has no effect in this mode and is ignored (a warning is logged), while a client certificate/key is still applied for mTLS. For `VERIFY_CA` and `STRICT`, a trust store and a CA certificate cannot both take effect: when both are configured the trust store is used and the CA certificate is ignored (a warning is logged). A trust store and a client certificate (`sslcert`) still cannot be configured together and throw `ClientMisconfigurationException`. `ssl_mode` values are matched case-insensitively and normalized to the canonical enum name (`DISABLED`, `TRUST`, `VERIFY_CA`, `STRICT`) when the client is built; an unrecognized value throws `ClientMisconfigurationException`.
 - Certificate-as-content support is compatibility-sensitive: any certificate or key value containing a PEM begin marker (`-----BEGIN`) is treated as inline PEM content, otherwise it is treated as a file path (also searched in the home directory and on the classpath).