Skip to content

OkHttpGrpcSender ignores the client certificate when no trusted certificates are configured #8754

Description

@thswlsqls

Describe the bug
An OTLP gRPC exporter configured with a client key/certificate but no trusted certificates never presents that certificate during the TLS handshake, with no exception or warning.

Steps to reproduce
Against an mTLS-enabled collector:

OtlpGrpcSpanExporter.builder()
    .setEndpoint("https://collector:4317")
    .setClientTls(privateKeyPem, certificatePem) // no setTrustedCertificates(...)
    .build();

Setting only otel.exporter.otlp.client.key and otel.exporter.otlp.client.certificate through autoconfigure does the same.

What did you expect to see?
The client certificate presented, with the platform default trust store used for server verification — what OkHttpHttpSender does since #8565 (issue #8562, the HTTP side of this).

What did you see instead?
The collector rejects the connection: no client certificate. OkHttpGrpcSender.<init>() (exporters/sender/okhttp/.../internal/OkHttpGrpcSender.java line 132) guards on sslContext != null && trustManager != null, and TlsConfigHelper.getTrustManager() stays null unless trusted certificates are also configured. The branch is skipped, so OkHttp uses its own SSLSocketFactory, which has no key manager. #8565 fixed only the HTTP sender.

What version and what artifacts are you using?
Artifacts: opentelemetry-exporter-otlp, opentelemetry-exporter-sender-okhttp
Version: main @ 3a9fdc6 (1.66.0-SNAPSHOT)
How did you reference these artifacts? opentelemetry-bom

Environment
Compiler: Temurin 21
OS: N/A

Additional context
OkHttpGrpcSender is the default gRPC sender. AbstractGrpcTelemetryExporterTest.clientTls() always sets trusted certificates too, so this combination was never exercised.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions