Updated CHANGELOG.md

Author: Debashismitra01

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+### SDK
+
+#### Exporters
+
+* OTLP: Fix OkHttp HTTP sender dropping client certificates when client TLS is configured without custom trusted certificates.
+
 ## Version 1.63.0 (2026-06-05)
 
 ### API

exporters/common/src/main/java/io/opentelemetry/exporter/internal/TlsUtil.java

@@ -95,9 +95,8 @@ public static X509KeyManager keyManager(byte[] privateKeyPem, byte[] certificate
       throw new SSLException("Could not build KeyManagerFactory from clientKeysPem.", e);
     }
   }
-  /**
-   * Returns the platform default {@link X509TrustManager}.
-   */
+
+  /** Returns the platform default {@link X509TrustManager}. */
   public static X509TrustManager defaultTrustManager() throws SSLException {
     try {
       TrustManagerFactory tmf =
@@ -117,6 +116,7 @@ public static X509TrustManager defaultTrustManager() throws SSLException {
       throw new SSLException("Could not build default TrustManager.", e);
     }
   }
+
   // Visible for testing
   static PrivateKey generatePrivateKey(PKCS8EncodedKeySpec keySpec, List<KeyFactory> keyFactories)
       throws SSLException {

exporters/otlp/testing-internal/src/main/java/io/opentelemetry/exporter/otlp/testing/internal/AbstractHttpTelemetryExporterTest.java

@@ -165,35 +165,36 @@ protected void configure(ServerBuilder sb) {
   // certificates are configured.
   @RegisterExtension
   @Order(4)
-  static final ServerExtension mtlsServer = new ServerExtension() {
-    @Override
-    protected void configure(ServerBuilder sb) {
-      sb.service(
-          "/v1/traces",
-          new CollectorService<>(
-              ExportTraceServiceRequest::parseFrom,
-              ExportTraceServiceRequest::getResourceSpansList));
-      sb.service(
-          "/v1/metrics",
-          new CollectorService<>(
-              ExportMetricsServiceRequest::parseFrom,
-              ExportMetricsServiceRequest::getResourceMetricsList));
-      sb.service(
-          "/v1/logs",
-          new CollectorService<>(
-              ExportLogsServiceRequest::parseFrom,
-              ExportLogsServiceRequest::getResourceLogsList));
-
-      sb.http(0);
-      sb.https(0);
-      sb.tls(TlsKeyPair.of(certificate.privateKey(), certificate.certificate()));
-      sb.tlsCustomizer(
-          ssl -> {
-            ssl.trustManager(clientCertificate.certificate());
-            ssl.clientAuth(ClientAuth.REQUIRE);
-          });
-    }
-  };
+  static final ServerExtension mtlsServer =
+      new ServerExtension() {
+        @Override
+        protected void configure(ServerBuilder sb) {
+          sb.service(
+              "/v1/traces",
+              new CollectorService<>(
+                  ExportTraceServiceRequest::parseFrom,
+                  ExportTraceServiceRequest::getResourceSpansList));
+          sb.service(
+              "/v1/metrics",
+              new CollectorService<>(
+                  ExportMetricsServiceRequest::parseFrom,
+                  ExportMetricsServiceRequest::getResourceMetricsList));
+          sb.service(
+              "/v1/logs",
+              new CollectorService<>(
+                  ExportLogsServiceRequest::parseFrom,
+                  ExportLogsServiceRequest::getResourceLogsList));
+
+          sb.http(0);
+          sb.https(0);
+          sb.tls(TlsKeyPair.of(certificate.privateKey(), certificate.certificate()));
+          sb.tlsCustomizer(
+              ssl -> {
+                ssl.trustManager(clientCertificate.certificate());
+                ssl.clientAuth(ClientAuth.REQUIRE);
+              });
+        }
+      };
 
   private static class CollectorService<T> implements HttpService {
     private final ThrowingExtractor<byte[], T, InvalidProtocolBufferException> parse;
@@ -505,8 +506,7 @@ void clientTlsWithoutTrustedCertificates(byte[] privateKey) throws Exception {
             .setEndpoint(mtlsServer.httpsUri() + path)
             // Intentionally DO NOT configure trusted certificates.
             .setClientTls(
-                privateKey,
-                Files.readAllBytes(clientCertificate.certificateFile().toPath()))
+                privateKey, Files.readAllBytes(clientCertificate.certificateFile().toPath()))
             .build()) {
 
       CompletableResultCode result =
@@ -515,6 +515,7 @@ void clientTlsWithoutTrustedCertificates(byte[] privateKey) throws Exception {
       assertThat(result.join(10, TimeUnit.SECONDS).isSuccess()).isTrue();
     }
   }
+
   private static class ClientPrivateKeyProvider implements ArgumentsProvider {
     @Override
     @SuppressWarnings("PrimitiveArrayPassedToVarargsMethod")

exporters/sender/okhttp/src/main/java/io/opentelemetry/exporter/sender/okhttp/internal/OkHttpHttpSender.java

@@ -8,7 +8,6 @@
 import io.opentelemetry.api.impl.InstrumentationUtil;
 import io.opentelemetry.exporter.internal.RetryUtil;
 import io.opentelemetry.exporter.internal.TlsUtil;
-import javax.net.ssl.SSLException;
 import io.opentelemetry.sdk.common.CompletableResultCode;
 import io.opentelemetry.sdk.common.export.Compressor;
 import io.opentelemetry.sdk.common.export.HttpResponse;
@@ -30,6 +29,7 @@
 import java.util.logging.Logger;
 import javax.annotation.Nullable;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLException;
 import javax.net.ssl.X509TrustManager;
 import okhttp3.Call;
 import okhttp3.Callback;
@@ -120,9 +120,7 @@ public OkHttpHttpSender(
           throw new IllegalStateException("Unable to initialize default trust manager", e);
         }
       }
-      builder.sslSocketFactory(
-          sslContext.getSocketFactory(),
-          effectiveTrustManager);
+      builder.sslSocketFactory(sslContext.getSocketFactory(), effectiveTrustManager);
     }
 
     this.client = builder.build();