ClientBuilder.trustStore() isn't respected when creating a client

[niloc132]

jakarta.ws.rs.client.ClientBuilder#trustStore isn't used in the creation process - if a server has a custom truststore that its certificate is signed by, the client will have an error when connecting.

As a workaround, the truststore can be passed to the underlying ClientConnector directly.

            final ClientConnector clientConnector = new ClientConnector();

            // Workaround, explicitly create the sslcontextfactory and pass to the connector
            SslContextFactory.Client sslContextFactory = new SslContextFactory.Client();
            sslContextFactory.setTrustStore(keyStore);
            clientConnector.setSslContextFactory(sslContextFactory);


            final ClientConnectionFactory.Info h1 = HttpClientConnectionFactory.HTTP11;
            final HTTP2Client http2Client = new HTTP2Client(clientConnector);
            final ClientConnectionFactory.Info h2 = new ClientConnectionFactoryOverHTTP2.HTTP2(http2Client);

            final HttpClientTransport transport = new HttpClientTransportDynamic(clientConnector, h2, h1);

            final HttpClient c = new HttpClient(transport);
            ClientBuilder clientBuilder =
                    ClientBuilder.newBuilder().register(new JettyClientEngine(c));

            // This will not work as of 1.0.0-alpha2
            clientBuilder = clientBuilder.trustStore(keyStore);

[jamezp]

Thanks for the detailed report and workaround, @niloc132 and sorry for the delay.

I dug into this, and I believe the root cause is in how the engine is being registered rather than a bug in resteasy-jetty itself. In your snippet, you're manually building the Jetty HttpClient and calling:

ClientBuilder clientBuilder = ClientBuilder.newBuilder().register(new JettyClientEngine(c));
clientBuilder = clientBuilder.trustStore(keyStore);

Registering a pre-built ClientHttpEngine via .register(...) bypasses the ClientHttpEngineFactory SPI (JettyClientHttpEngineFactory) entirely. RESTEasy only applies trustStore()/keyStore()/other builder-level TLS config when it constructs the engine itself at .build() time via that factory — once you hand it an already-constructed engine, there's no hook left for it to inject an SSLContext into it. So trustStore() being ignored in that flow is expected, not a bug.

Also, RESTEasy itself had a real bug in resolving trustStore()/keyStore() into an SSLContext (RESTEASY-3557), but that was fixed upstream in RESTEasy 6.2.12.Final — which resteasy-jetty has been on since before this issue was filed (we're currently on 7.0.3.Final).

Putting those together: if you drop the manual .register(new JettyClientEngine(c)) call and just let RESTEasy discover JettyClientHttpEngineFactory automatically —

ClientBuilder.newBuilder()
        .trustStore(keyStore)
        .build();

— trustStore() should be honored correctly on current versions. Could you try that and confirm on your end? If it still doesn't work that way, we'll reopen this as an actual bug.

[niloc132]

Looks like we were on 6.2.12.Final at the time that I filed this.

We were indeed using the client engine, so that h2 was supported at all, the SPI wiring didn't support it. We also were using the builder api, but as you describe, that is ignored. It probably should be made clear that doing any registration means that the builder APIs aren't expected to work. I'd lean towards somehow trying to get register to not return an incomplete ClientBuilder to avoid this misconception, but I recognize this is out of your control in resteasy-jetty.

[jamezp]

Yeah. The idea behind the org.jboss.resteasy.client.jaxrs.engine.ClientHttpEngineFactory is that the user should hopefully just be able to use the jakarta.ws.rs.client.ClientBuilder and just have the implementation they want on the class path. Registering the org.jboss.resteasy.client.jaxrs.ClientHttpEngine on the ClientBuilder is more for when you need to fully configure the client.

FWIW I'm working on this project a bit and refactoring the it to hopefully help it work better :) I'm going to be requiring a minimum of RESTEasy 7.0.x and Jakarta REST 4.0. Also upgrading Jetty to 12.1.x.