Replace deprecated SSLConnectionSocketFactory with recommended API

[joviegas]

Motivation and Context

Apache HttpClient 5.x deprecated ConnectionSocketFactory in favor of the new TlsSocketStrategy interface. This change updates the AWS SDK's Apache5 HTTP client to fully adopt the modern TLS configuration approach, completing the migration by removing the deprecated API entirely.

Historical Context: Earlier versions of this implementation incorrectly used SSLConnectionSocketFactory instead of the more general ConnectionSocketFactory interface. The correct API should have been ConnectionSocketFactory, which was consistent with the SDK's Apache4 client implementation. However, Apache HttpClient 5.x has since deprecated ConnectionSocketFactory entirely as part of a broader architectural redesign to better separate concerns between socket creation and TLS upgrade operations.

The new TlsSocketStrategy interface provides a cleaner abstraction specifically for TLS upgrade operations, moving away from the socket factory pattern that mixed plain socket creation with TLS layering concerns.

Modifications

Added

• New tlsSocketStrategy() method in Apache5HttpClient.Builder to support the modern TLS configuration approach

Modified

• SdkTlsSocketFactory now extends DefaultClientTlsStrategy instead of SSLConnectionSocketFactory
• Connection manager creation updated to use setTlsSocketStrategy() instead of deprecated setSSLSocketFactory()
• Socket initialization updated to use initializeSocket() instead of prepareSocket()
• Method signatures updated to use upgrade() for TLS socket upgrades instead of connectSocket()

Removed

• Deprecated socketFactory() method - completely removed to eliminate legacy API surface
• Legacy socket wrapper classes (DelegateSocket, SdkSocket) - replaced with SSL-specific SdkSslSocket
• Backward compatibility adapter - no longer needed as deprecated API is fully removed

Breaking Changes

• socketFactory() method removed: Users must migrate to tlsSocketStrategy()
• Legacy socket factory support discontinued: Only TlsSocketStrategy is supported

Migration Path

Users must migrate from the deprecated approach to the modern API:

Before (Deprecated API):

import org.apache.hc.client5.http.socket.ConnectionSocketFactory;
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
import org.apache.hc.client5.http.ssl.DefaultHostnameVerifier;

// OLD: Using ConnectionSocketFactory (no longer supported)
ConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
    customSslContext,
    new String[] {"TLSv1.2", "TLSv1.3"}, // Supported protocols
    null, // Default cipher suites
    new DefaultHostnameVerifier()
);

Apache5HttpClient httpClient = Apache5HttpClient.builder()
    .socketFactory(sslSocketFactory) // ❌ Method removed
    .build();

After (Modern API):

import org.apache.hc.client5.http.ssl.TlsSocketStrategy;
import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy;
import org.apache.hc.client5.http.ssl.DefaultHostnameVerifier;
import org.apache.hc.core5.reactor.ssl.SSLBufferMode;

// NEW: Using TlsSocketStrategy (required)
TlsSocketStrategy tlsSocketStrategy = new DefaultClientTlsStrategy(
    customSslContext,
    new String[] {"TLSv1.2", "TLSv1.3"}, // Supported protocols
    null, // Default cipher suites
    SSLBufferMode.STATIC, // SSL buffer mode
    new DefaultHostnameVerifier()
);

Apache5HttpClient httpClient = Apache5HttpClient.builder()
    .tlsSocketStrategy(tlsSocketStrategy) // ✅ Modern method
    .build();

Testing

• Added new Test cases

License

• I confirm that this pull request can be released under the Apache 2 license

License

• I confirm that this pull request can be released under the Apache 2 license

[sonarqubecloud]

Quality Gate failed

Failed conditions
E Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[dagnir]

Can we explain that this is here to ease migration from 4.5.x?

[joviegas]

done

[dagnir]

minor: can we fix the test names so they match our normal conventions? i.e. methodToTest_when_expectedBehavior

[joviegas]

done

[dagnir]

can we just disallow setting both?

[joviegas]

done

[github-actions]

This pull request has been closed and the conversation has been locked. Comments on closed PRs are hard for our team to see. If you need more assistance, please open a new issue that references this one.