Noop Hostname Verifier option does not appear to work with Java 21

[r-moreira]

Hello!

I'm using Java 21, Spring Boot 3.2.0 and Feign-HC5 13.1.

My code worked with Java 17 and stopped working when I migrated to Java 21 and Spring Boot 3.2.0

I need to disable hostname checking, but it seems these settings have no effect at all:

@Bean
public Logger.Level feignLoggerLevel() {
    return Logger.Level.FULL;
}

@Bean
public Feign.Builder feignBuilder() {
    return Feign.builder()
            .options(new feign.Request.Options(
                    props.getHttp().getFeign().getConnectTimeout(), TimeUnit.MILLISECONDS,
                    props.getHttp().getFeign().getReadTimeout(), TimeUnit.MILLISECONDS,
                    props.getHttp().getFeign().isFollowRedirects()))
            .retryer(Retryer.NEVER_RETRY)
            .client(new ApacheHttp5Client(buildCustomHttpClient()));
}

private CloseableHttpClient buildCustomHttpClient() {
      var customClient = HttpClients.custom().setConnectionManager(getHttpClientConnectionManager());
      
     return customClient.build();
  }

private HttpClientConnectionManager getHttpClientConnectionManager() {
    SSLConnectionSocketFactory sslConnectionSocketFactory = SSLConnectionSocketFactoryBuilder.create()
            .setSslContext(getSSLContext())
            .setHostnameVerifier(new NoopHostnameVerifier()).build();

    var builder = PoolingHttpClientConnectionManagerBuilder
            .create()
            .setDefaultConnectionConfig(withKeepAliveOptionOrDefault())
            .setSSLSocketFactory(sslConnectionSocketFactory);

    return builder.build();
}

private SSLContext getSSLContext() {
    try {
        return SSLContexts.custom().loadTrustMaterial(null, new TrustSelfSignedStrategy()).build();
    } catch (Exception ex) {
        throw new InternalException(ex);
    }
}

The error:
Caused by: javax.net.ssl.SSLPeerUnverifiedException: Certificate for <XX.XXX.XXX.XXX> doesn't match any of the subject alternative names: [] at org.apache.hc.client5.http.ssl.DefaultHostnameVerifier.matchIPAddress(DefaultHostnameVerifier.java:134) at org.apache.hc.client5.http.ssl.DefaultHostnameVerifier.verify(DefaultHostnameVerifier.java:108) at org.apache.hc.client5.http.ssl.TlsSessionValidator.verifySession(TlsSessionValidator.java:113) at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.verifySession(SSLConnectionSocketFactory.java:340) at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.verifyHostname(SSLConnectionSocketFactory.java:329) at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.executeHandshake(SSLConnectionSocketFactory.java:304) at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:275) at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:251) at org.apache.hc.client5.http.impl.io.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:181) at org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:447) at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:162) at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:172) at org.apache.hc.client5.http.impl.classic.ConnectExec.execute(ConnectExec.java:142) at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51) at org.apache.hc.client5.http.impl.classic.ProtocolExec.execute(ProtocolExec.java:192) at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51) at org.apache.hc.client5.http.impl.classic.HttpRequestRetryExec.execute(HttpRequestRetryExec.java:96) at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51) at org.apache.hc.client5.http.impl.classic.ContentCompressionExec.execute(ContentCompressionExec.java:152) at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51) at org.apache.hc.client5.http.impl.classic.RedirectExec.execute(RedirectExec.java:115) at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51) at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute(InternalHttpClient.java:170) at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:87) at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:55) at feign.hc5.ApacheHttp5Client.execute(ApacheHttp5Client.java:88) at feign.SynchronousMethodHandler.executeAndDecode(SynchronousMethodHandler.java:100)

Is there something wrong with the code above?