title: Allow insecure HTTPS connection for Java JDK 11 HttpClient
body: <p>Sometimes it is needed to allow insecure HTTPS connections, e.g. in some web-crawling applications which should work with any site. I used <a href="https://stackoverflow.com/questions/1201048/allowing-java-to-use-an-untrusted-certificate-for-ssl-https-connection">one such solution</a> with old HttpsURLConnection API which was recently superseded by the <a href="https://openjdk.java.net/groups/net/httpclient/intro.html" rel="noreferrer">new HttpClient API</a> in JDK 11. What is the way to allow insecure HTTPS connections (self-signed or expired certificate) with this new API?</p>
  
  <p>UPD: The code I tried (in Kotlin but maps directly to Java):</p>
  
  <pre><code>    val trustAllCerts = arrayOf&lt;TrustManager&gt;(object: X509TrustManager {
          override fun getAcceptedIssuers(): Array&lt;X509Certificate&gt;? = null
          override fun checkClientTrusted(certs: Array&lt;X509Certificate&gt;, authType: String) {}
          override fun checkServerTrusted(certs: Array&lt;X509Certificate&gt;, authType: String) {}
      })
  
      val sslContext = SSLContext.getInstance("SSL")
      sslContext.init(null, trustAllCerts, SecureRandom())
  
      val sslParams = SSLParameters()
      // This should prevent host validation
      sslParams.endpointIdentificationAlgorithm = ""
  
      httpClient = HttpClient.newBuilder()
          .sslContext(sslContext)
          .sslParameters(sslParams)
          .build()
  </code></pre>
  
  <p>But on sending I have exception (trying on localhost with self-signed certificate):</p>
  
  <pre><code>java.io.IOException: No name matching localhost found
  </code></pre>
  
  <p>Using IP address instead of localhost gives "No subject alternative names present" exception.</p>
  
  <p>After some debugging of JDK I found that <code>sslParams</code> are really ignored in the place the exception is thrown and some locally created instance is used. Further debugging revealed that the only way to affect the hostname verification algorithm is setting <code>jdk.internal.httpclient.disableHostnameVerification</code> system property to true. And that's seems to be a solution. <code>SSLParameters</code> in the code above have no effect so this part can be discarded. Making it configurable only globally looks like serious design flaw in new HttpClient API.</p>