{"record":{"id":"04931c7bdedf58b3","repo":"spring-projects/spring-ai","slug":"both-or-none-of-sslsocketfactory-and-trustmanag-04931c","errorCode":null,"errorMessage":"Both or none of `sslSocketFactory` and `trustManager` must be set, but only one was set","messagePattern":"Both or none of `sslSocketFactory` and `trustManager` must be set, but only one was set","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"models/spring-ai-openai/src/main/java/org/springframework/ai/openai/http/okhttp/SpringAiOpenAiHttpClient.java","lineNumber":583,"sourceCode":"\t\t\t\t\t: defaultDispatcherExecutor();\n\t\t\tExecutorService dispatcherExecutor = ContextExecutorService.wrap(dispatcherBase,\n\t\t\t\t\tContextSnapshotFactory.builder().build());\n\t\t\tokBuilder.dispatcher(new Dispatcher(dispatcherExecutor));\n\n\t\t\tif (this.maxIdleConnections != null && this.keepAliveDuration != null) {\n\t\t\t\tokBuilder.connectionPool(new ConnectionPool(this.maxIdleConnections, this.keepAliveDuration.toNanos(),\n\t\t\t\t\t\tTimeUnit.NANOSECONDS));\n\t\t\t}\n\t\t\telse if ((this.maxIdleConnections == null) != (this.keepAliveDuration == null)) {\n\t\t\t\tthrow new IllegalStateException(\n\t\t\t\t\t\t\"Both or none of `maxIdleConnections` and `keepAliveDuration` must be set, but only one was set\");\n\t\t\t}\n\n\t\t\tif (this.sslSocketFactory != null && this.trustManager != null) {\n\t\t\t\tokBuilder.sslSocketFactory(this.sslSocketFactory, this.trustManager);\n\t\t\t}\n\t\t\telse if ((this.sslSocketFactory == null) != (this.trustManager == null)) {\n\t\t\t\tthrow new IllegalStateException(\n\t\t\t\t\t\t\"Both or none of `sslSocketFactory` and `trustManager` must be set, but only one was set\");\n\t\t\t}\n\n\t\t\tif (this.hostnameVerifier != null) {\n\t\t\t\tokBuilder.hostnameVerifier(this.hostnameVerifier);\n\t\t\t}\n\n\t\t\tOkHttpClient okClient = okBuilder.build();\n\t\t\t// Same-host traffic: raise per-host limit to overall request limit. Matches\n\t\t\t// the SDK's tuning at the bottom of `OkHttpClient.Builder.build()`.\n\t\t\tokClient.dispatcher().setMaxRequestsPerHost(okClient.dispatcher().getMaxRequests());\n\n\t\t\tif (this.meterRegistry != null) {\n\t\t\t\tnew OkHttpConnectionPoolMetrics(okClient.connectionPool(), this.meterTags).bindTo(this.meterRegistry);\n\t\t\t}\n\n\t\t\treturn new SpringAiOpenAiHttpClient(okClient, ownsDispatcherExecutor);\n\t\t}","sourceCodeStart":565,"sourceCodeEnd":601,"githubUrl":"https://github.com/spring-projects/spring-ai/blob/98a7beda4f29d80a71c5837eb4053b03a93a46f7/models/spring-ai-openai/src/main/java/org/springframework/ai/openai/http/okhttp/SpringAiOpenAiHttpClient.java#L565-L601","documentation":"Builder consistency check in SpringAiOpenAiHttpClient.build: sslSocketFactory and trustManager are coupled TLS settings and exactly one of them was provided; partial TLS customization would leave the client in an inconsistent state.","triggerScenarios":"Calling builder().sslSocketFactory(factory).build() without trustManager (or the reverse), detected at build() in SpringAiOpenAiHttpClient.java:583.","commonSituations":"Custom CA / mutual-TLS setups where a developer sets the socket factory but forgets the trust manager, or properties files that populate one TLS setting but not its pair.","solutions":["Set both together, deriving the trust manager from the same SSLContext/KeyStore as the socket factory.","Remove both to use the system default TLS configuration.","Build the client in an init/health check so the misconfiguration surfaces at startup."],"exampleFix":"// before\nbuilder().sslSocketFactory(sslContext.getSocketFactory()).build();\n// after\nTrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\ntmf.init(keyStore);\nbuilder().sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) tmf.getTrustManagers()[0]).build();","handlingStrategy":"validation","validationCode":"if ((sslSocketFactory == null) != (trustManager == null)) {\n    throw new IllegalStateException(\"Set both sslSocketFactory and trustManager, or neither\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    client = SpringAiOpenAiHttpClient.builder()\n        .sslSocketFactory(factory, trustManager)\n        .build();\n} catch (IllegalStateException e) {\n    throw new ClientConfigurationException(\"Invalid TLS configuration: \" + e.getMessage(), e);\n}","preventionTips":["Derive sslSocketFactory and trustManager from the same SSLContext","Configure custom CAs via one helper that sets both","Eagerly build the client during application startup"],"tags":["configuration","tls","builder"],"backgroundTag":"conflicting-config-options","analyzedSha":"98a7beda4f29d80a71c5837eb4053b03a93a46f7","analyzedAt":"2026-09-11T14:15:49.441Z","contentChangedAt":"2026-09-11T14:15:49.441Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}