Address review feedback for mTLS default trust handling

Author: Debashismitra01

CHANGELOG.md

@@ -6,7 +6,7 @@
 
 #### Exporters
 
-* OTLP: Fix OkHttp HTTP sender dropping client certificates when client TLS is configured without custom trusted certificates.
+* Fix OkHttp client mTLS when using the platform default trust store. (#8565)
 
 ## Version 1.63.0 (2026-06-05)
 

exporters/common/src/main/java/io/opentelemetry/exporter/internal/TlsConfigHelper.java

@@ -112,7 +112,7 @@ public X509TrustManager getTrustManager() {
   }
 
   @Nullable
-  public X509TrustManager getEffectiveTrustManager() throws SSLException {
+  X509TrustManager getEffectiveTrustManager() throws SSLException {
     if (trustManager != null) {
       return trustManager;
     }

exporters/common/src/test/java/io/opentelemetry/exporter/internal/TlsConfigHelperTest.java

@@ -10,14 +10,14 @@
 
 import com.linecorp.armeria.testing.junit5.server.SelfSignedCertificateExtension;
 import io.opentelemetry.internal.testing.slf4j.SuppressLogger;
-import java.security.Security;
 import java.security.cert.CertificateEncodingException;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLException;
 import javax.net.ssl.X509TrustManager;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.junit.jupiter.api.extension.RegisterExtension;
+import org.junitpioneer.jupiter.SetSystemProperty;
 import org.mockito.junit.jupiter.MockitoExtension;
 
 @ExtendWith(MockitoExtension.class)
@@ -98,32 +98,11 @@ void setSslContext_AlreadyExists_Throws() throws Exception {
   }
 
   @Test
-  void getEffectiveTrustManager_returnsConfiguredTrustManager()
-      throws CertificateEncodingException, SSLException {
-    helper.setTrustManagerFromCerts(serverTls.certificate().getEncoded());
-
-    assertThat(helper.getEffectiveTrustManager()).isSameAs(helper.getTrustManager());
-  }
-
-  @Test
-  void getEffectiveTrustManager_returnsDefaultTrustManager() throws SSLException {
-    assertThat(helper.getEffectiveTrustManager()).isNotNull();
-  }
-
-  @Test
+  @SetSystemProperty(key = "ssl.TrustManagerFactory.algorithm", value = "invalid")
   void getSslContext_wrapsDefaultTrustManagerFailure() {
-    String originalAlgorithm = Security.getProperty("ssl.TrustManagerFactory.algorithm");
-
-    try {
-      Security.setProperty("ssl.TrustManagerFactory.algorithm", "invalid");
-
-      assertThatThrownBy(() -> helper.getSslContext())
-          .isInstanceOf(IllegalArgumentException.class)
-          .hasCauseInstanceOf(SSLException.class);
-
-    } finally {
-      Security.setProperty("ssl.TrustManagerFactory.algorithm", originalAlgorithm);
-    }
+    assertThatThrownBy(() -> helper.getSslContext())
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasCauseInstanceOf(SSLException.class);
   }
 
   @Test

exporters/sender/okhttp/src/test/java/io/opentelemetry/exporter/sender/okhttp/internal/OkHttpHttpSenderTest.java

@@ -7,6 +7,7 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 
 import io.opentelemetry.sdk.common.export.HttpResponse;
 import io.opentelemetry.sdk.common.export.MessageWriter;
@@ -70,22 +71,21 @@ void constructor_usesDefaultTrustManagerWhenTrustManagerIsNull() throws Exceptio
     SSLContext sslContext = SSLContext.getInstance("TLS");
     sslContext.init(null, null, null);
 
-    OkHttpHttpSender sender =
-        new OkHttpHttpSender(
-            URI.create("https://localhost"),
-            "text/plain",
-            null,
-            Duration.ofSeconds(10),
-            Duration.ofSeconds(10),
-            Collections::emptyMap,
-            null,
-            null,
-            sslContext,
-            null,
-            null,
-            Long.MAX_VALUE);
-
-    assertThat(sender).isNotNull();
+    assertDoesNotThrow(
+        () ->
+            new OkHttpHttpSender(
+                URI.create("https://localhost"),
+                "text/plain",
+                null,
+                Duration.ofSeconds(10),
+                Duration.ofSeconds(10),
+                Collections::emptyMap,
+                null,
+                null,
+                sslContext,
+                null,
+                null,
+                Long.MAX_VALUE));
   }
 
   @Test