Describe the bug
An OTLP gRPC exporter configured with a client key/certificate but no trusted certificates never presents that certificate during the TLS handshake, with no exception or warning.
Steps to reproduce
Against an mTLS-enabled collector:
OtlpGrpcSpanExporter.builder()
.setEndpoint("https://collector:4317")
.setClientTls(privateKeyPem, certificatePem) // no setTrustedCertificates(...)
.build();
Setting only otel.exporter.otlp.client.key and otel.exporter.otlp.client.certificate through autoconfigure does the same.
What did you expect to see?
The client certificate presented, with the platform default trust store used for server verification — what OkHttpHttpSender does since #8565 (issue #8562, the HTTP side of this).
What did you see instead?
The collector rejects the connection: no client certificate. OkHttpGrpcSender.<init>() (exporters/sender/okhttp/.../internal/OkHttpGrpcSender.java line 132) guards on sslContext != null && trustManager != null, and TlsConfigHelper.getTrustManager() stays null unless trusted certificates are also configured. The branch is skipped, so OkHttp uses its own SSLSocketFactory, which has no key manager. #8565 fixed only the HTTP sender.
What version and what artifacts are you using?
Artifacts: opentelemetry-exporter-otlp, opentelemetry-exporter-sender-okhttp
Version: main @ 3a9fdc6 (1.66.0-SNAPSHOT)
How did you reference these artifacts? opentelemetry-bom
Environment
Compiler: Temurin 21
OS: N/A
Additional context
OkHttpGrpcSender is the default gRPC sender. AbstractGrpcTelemetryExporterTest.clientTls() always sets trusted certificates too, so this combination was never exercised.
Describe the bug
An OTLP gRPC exporter configured with a client key/certificate but no trusted certificates never presents that certificate during the TLS handshake, with no exception or warning.
Steps to reproduce
Against an mTLS-enabled collector:
Setting only
otel.exporter.otlp.client.keyandotel.exporter.otlp.client.certificatethrough autoconfigure does the same.What did you expect to see?
The client certificate presented, with the platform default trust store used for server verification — what
OkHttpHttpSenderdoes since #8565 (issue #8562, the HTTP side of this).What did you see instead?
The collector rejects the connection: no client certificate.
OkHttpGrpcSender.<init>()(exporters/sender/okhttp/.../internal/OkHttpGrpcSender.javaline 132) guards onsslContext != null && trustManager != null, andTlsConfigHelper.getTrustManager()stays null unless trusted certificates are also configured. The branch is skipped, so OkHttp uses its ownSSLSocketFactory, which has no key manager. #8565 fixed only the HTTP sender.What version and what artifacts are you using?
Artifacts: opentelemetry-exporter-otlp, opentelemetry-exporter-sender-okhttp
Version: main @ 3a9fdc6 (1.66.0-SNAPSHOT)
How did you reference these artifacts? opentelemetry-bom
Environment
Compiler: Temurin 21
OS: N/A
Additional context
OkHttpGrpcSenderis the default gRPC sender.AbstractGrpcTelemetryExporterTest.clientTls()always sets trusted certificates too, so this combination was never exercised.