Address review feedback for mTLS default trust handling

Author: Debashismitra01

CHANGELOG.md

@@ -6,7 +6,7 @@
 
 #### Exporters
 
-* OTLP: Fix OkHttp HTTP sender dropping client certificates when client TLS is configured without custom trusted certificates.
+* Fix OkHttp client mTLS when using the platform default trust store ([#8565](https://github.com/open-telemetry/opentelemetry-java/pull/8565))
 
 ## Version 1.63.0 (2026-06-05)
 

exporters/common/src/main/java/io/opentelemetry/exporter/internal/TlsConfigHelper.java

@@ -111,8 +111,7 @@ public X509TrustManager getTrustManager() {
     return trustManager;
   }
 
-  @Nullable
-  public X509TrustManager getEffectiveTrustManager() throws SSLException {
+  private X509TrustManager getEffectiveTrustManager() throws SSLException {
     if (trustManager != null) {
       return trustManager;
     }

exporters/common/src/main/java/io/opentelemetry/exporter/internal/TlsUtil.java

@@ -105,18 +105,23 @@ public static X509TrustManager defaultTrustManager() throws SSLException {
       // Initialize with the platform default trust store.
       tmf.init((KeyStore) null);
 
-      for (TrustManager trustManager : tmf.getTrustManagers()) {
-        if (trustManager instanceof X509TrustManager) {
-          return (X509TrustManager) trustManager;
-        }
-      }
-
-      throw new SSLException("No X509TrustManager found");
+      return defaultTrustManager(tmf);
     } catch (KeyStoreException | NoSuchAlgorithmException e) {
       throw new SSLException("Could not build default TrustManager.", e);
     }
   }
 
+  // Visible for testing
+  static X509TrustManager defaultTrustManager(TrustManagerFactory tmf) throws SSLException {
+    for (TrustManager trustManager : tmf.getTrustManagers()) {
+      if (trustManager instanceof X509TrustManager) {
+        return (X509TrustManager) trustManager;
+      }
+    }
+
+    throw new SSLException("No X509TrustManager found");
+  }
+
   // Visible for testing
   static PrivateKey generatePrivateKey(PKCS8EncodedKeySpec keySpec, List<KeyFactory> keyFactories)
       throws SSLException {

exporters/common/src/test/java/io/opentelemetry/exporter/internal/TlsConfigHelperTest.java

@@ -97,19 +97,6 @@ void setSslContext_AlreadyExists_Throws() throws Exception {
         .hasMessageContaining("sslContext or trustManager has been previously configured");
   }
 
-  @Test
-  void getEffectiveTrustManager_returnsConfiguredTrustManager()
-      throws CertificateEncodingException, SSLException {
-    helper.setTrustManagerFromCerts(serverTls.certificate().getEncoded());
-
-    assertThat(helper.getEffectiveTrustManager()).isSameAs(helper.getTrustManager());
-  }
-
-  @Test
-  void getEffectiveTrustManager_returnsDefaultTrustManager() throws SSLException {
-    assertThat(helper.getEffectiveTrustManager()).isNotNull();
-  }
-
   @Test
   void getSslContext_wrapsDefaultTrustManagerFailure() {
     String originalAlgorithm = Security.getProperty("ssl.TrustManagerFactory.algorithm");

exporters/common/src/test/java/io/opentelemetry/exporter/internal/TlsUtilTest.java

@@ -5,8 +5,9 @@
 
 package io.opentelemetry.exporter.internal;
 
+import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatCode;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.mock;
 
 import com.linecorp.armeria.internal.common.util.SelfSignedCertificate;
 import java.io.File;
@@ -16,15 +17,19 @@
 import java.nio.file.Path;
 import java.nio.file.StandardOpenOption;
 import java.security.KeyFactory;
-import java.security.NoSuchAlgorithmException;
-import java.security.Security;
+import java.security.KeyStore;
 import java.security.cert.CertificateException;
 import java.security.spec.PKCS8EncodedKeySpec;
 import java.time.Instant;
 import java.util.Collections;
 import java.util.Date;
 import java.util.stream.Stream;
+import javax.net.ssl.ManagerFactoryParameters;
 import javax.net.ssl.SSLException;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.TrustManagerFactorySpi;
+import javax.net.ssl.X509TrustManager;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
@@ -88,20 +93,36 @@ void defaultTrustManager() {
   }
 
   @Test
-  void defaultTrustManager_NoSuchAlgorithmException() {
-    String originalAlgorithm = Security.getProperty("ssl.TrustManagerFactory.algorithm");
+  void defaultTrustManager_returnsX509TrustManager() throws Exception {
+    X509TrustManager trustManager = mock(X509TrustManager.class);
 
-    try {
-      Security.setProperty("ssl.TrustManagerFactory.algorithm", "invalid-algorithm");
+    assertThat(TlsUtil.defaultTrustManager(trustManagerFactory(new TrustManager[] {trustManager})))
+        .isSameAs(trustManager);
+  }
 
-      assertThatThrownBy(TlsUtil::defaultTrustManager)
-          .isInstanceOf(SSLException.class)
-          .hasMessage("Could not build default TrustManager.")
-          .hasCauseInstanceOf(NoSuchAlgorithmException.class);
+  private static TrustManagerFactory trustManagerFactory(TrustManager[] trustManagers) {
+    return new TrustManagerFactory(
+        new TrustManagerFactorySpi() {
+          @Override
+          protected void engineInit(KeyStore keyStore) {}
+
+          @Override
+          protected void engineInit(ManagerFactoryParameters spec) {}
+
+          @Override
+          protected TrustManager[] engineGetTrustManagers() {
+            return trustManagers;
+          }
+        },
+        null,
+        "test") {};
+  }
 
-    } finally {
-      Security.setProperty("ssl.TrustManagerFactory.algorithm", originalAlgorithm);
-    }
+  @Test
+  void defaultTrustManager_NoX509TrustManagerFound() {
+    assertThatCode(() -> TlsUtil.defaultTrustManager(trustManagerFactory(new TrustManager[0])))
+        .isInstanceOf(SSLException.class)
+        .hasMessage("No X509TrustManager found");
   }
 
   /**

exporters/sender/okhttp/src/test/java/io/opentelemetry/exporter/sender/okhttp/internal/OkHttpHttpSenderTest.java

@@ -7,6 +7,7 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 
 import io.opentelemetry.sdk.common.export.HttpResponse;
 import io.opentelemetry.sdk.common.export.MessageWriter;
@@ -70,22 +71,21 @@ void constructor_usesDefaultTrustManagerWhenTrustManagerIsNull() throws Exceptio
     SSLContext sslContext = SSLContext.getInstance("TLS");
     sslContext.init(null, null, null);
 
-    OkHttpHttpSender sender =
-        new OkHttpHttpSender(
-            URI.create("https://localhost"),
-            "text/plain",
-            null,
-            Duration.ofSeconds(10),
-            Duration.ofSeconds(10),
-            Collections::emptyMap,
-            null,
-            null,
-            sslContext,
-            null,
-            null,
-            Long.MAX_VALUE);
-
-    assertThat(sender).isNotNull();
+    assertDoesNotThrow(
+        () ->
+            new OkHttpHttpSender(
+                URI.create("https://localhost"),
+                "text/plain",
+                null,
+                Duration.ofSeconds(10),
+                Duration.ofSeconds(10),
+                Collections::emptyMap,
+                null,
+                null,
+                sslContext,
+                null,
+                null,
+                Long.MAX_VALUE));
   }
 
   @Test