Replace Apache HttpClient5 with Java's HttpURLConnection

[Alan Zimmer (alzimmermsft)]

Description

Replaces Apache HttpClient 5 with the JDK HttpURLConnection and HttpsURLConnection APIs in azure-security-keyvault-jca.

This keeps the JCA provider lightweight by removing Apache HttpClient and SLF4J from the library’s runtime dependency graph and shaded JAR. The public API and Java 8 baseline remain unchanged.

Changes

• Replaced Key Vault GET, POST, authentication-challenge, and AIA certificate download requests with HttpURLConnection.
• Preserved existing HTTP status handling, authentication flows, TLS trust configuration, and AIA chain-completion behavior.
• Added explicit AIA redirect handling, response-size limits, download timeouts, and cache-header processing.
• Removed Apache HttpClient 5 and slf4j-nop runtime dependencies.
• Removed Mockito Inline and Byte Buddy test dependencies, replacing static/construction mocks with focused test doubles and injectable HTTP seams.
• Updated TLS and mTLS samples and README snippets to use HttpsURLConnection while preserving the previous sample behavior.
• Added regression coverage for connection failures, authentication challenge headers, TLS setup, and HTTP response handling.

Validation

mvn -f sdk/keyvault/azure-security-keyvault-jca/pom.xml clean verify

Result: 251 tests passed with no failures or errors. 29 tests were skipped by existing test conditions.

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

Written with the help of vcolin7-copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
33 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
34 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR migrates azure-security-keyvault-jca off Apache HttpClient 5 to JDK networking primitives (HttpURLConnection / HttpsURLConnection), removing the Apache HttpClient and SLF4J runtime dependencies while preserving Key Vault JCA functionality (including AIA chain completion) and updating tests/samples accordingly.

Changes:

• Reworked HTTP and AIA-fetch logic to use HttpURLConnection, adding test seams (connection factories / response loaders) to keep unit tests deterministic.
• Refactored Key Vault client and test suite to avoid Mockito-inline and Apache HttpClient types (new scripted/test client helpers and TLS test utilities).
• Updated samples, README, module metadata, and Maven dependencies to reflect the new HTTP stack and reduced dependency surface.

Reviewed changes

Copilot reviewed 53 out of 53 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/SpecificPathCertificatesTest.java	Uses FileSystems separator when building test resource paths.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/ServerSocketTest.java	Replaces Apache HttpClient usage with HttpsURLConnection in TLS socket tests.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/PropertyConvertorUtils.java	Removes Configuration usage; reads system properties then environment variables.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/KeyVaultKeyStoreUnitTest.java	Reworks assertions to avoid Mockito construction mocking (uses reflection).
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/KeyVaultEncodeTest.java	Removes ByteBuddy RandomString; uses SecureRandom for test byte material.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/JreKeyStoreTest.java	Minor assertion cleanup (isEmpty() vs size check).
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/JcaTestUtils.java	Adds reusable TLS key/trust-manager delegates for tests.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/utils/JsonConverterUtilTest.java	Simplifies JSON tests; uses assertDoesNotThrow.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/utils/HttpUtilTest.java	Rebuilds HTTP tests around HttpURLConnection test doubles and new APIs.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/utils/AiaResponseCacheTest.java	Removes Mockito X509Certificate mocks; loads a real test certificate.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/utils/AiaCertificateChainTest.java	Replaces static HttpUtil mocking with injectable AIA response loader.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtilTest.java	Stops using static mocking; injects POST behavior for token retrieval.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/TestKeyVaultClient.java	New test client overriding HTTP GET via injected function.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/TestCertificateVersions.java	New helper to create CertificateVersion instances for tests.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/signature/KeyVaultKeylessRsaSsaPssSignatureTest.java	Removes Mockito usage; uses lightweight mock Key Vault client/keys.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/signature/KeyVaultKeylessEcSignatureTest.java	Removes Mockito usage; uses lightweight mock Key Vault client/keys.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/MockKeyVaultClient.java	New minimal KeyVaultClient subclass used by signature tests.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/mocking/MockPublicKey.java	New trivial PublicKey implementation for tests.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/mocking/MockPrivateKey.java	New trivial PrivateKey implementation for tests.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/mocking/MockKey.java	New trivial Key implementation for tests.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/mocking/MockCertificate.java	New trivial Certificate implementation for tests.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/KeyVaultClientTest.java	Reworks KeyVaultClient tests to use scripted HTTP/test clients instead of static mocks.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/JreKeyStoreTest.java	Minor assertion cleanup (isEmpty() vs size check).
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/JreKeyStoreFactoryTest.java	Uses assertNotEquals instead of assertFalse(a.equals(b)).
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/certificates/SpecificPathCertificatesTest.java	Uses FileSystems separator when building test resource paths.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/certificates/ClasspathCertificatesTest.java	Removes Mockito certificate mock; uses a test certificate implementation.
sdk/keyvault/azure-security-keyvault-jca/src/samples/java/com/azure/security/keyvault/jca/tls/ServerSSLSample.java	Updates TLS server sample; improves Content-Length calculation (UTF-8).
sdk/keyvault/azure-security-keyvault-jca/src/samples/java/com/azure/security/keyvault/jca/tls/ClientSSLSample.java	Replaces Apache HttpClient with HttpsURLConnection and explicit trust logic.
sdk/keyvault/azure-security-keyvault-jca/src/samples/java/com/azure/security/keyvault/jca/mtls/ServerMTLSSample.java	Updates mTLS server sample and response encoding handling.
sdk/keyvault/azure-security-keyvault-jca/src/samples/java/com/azure/security/keyvault/jca/mtls/ClientMTLSSample.java	Replaces Apache HttpClient with HttpsURLConnection and explicit identity/trust config.
sdk/keyvault/azure-security-keyvault-jca/src/main/resources/module-info.java	Updates descriptor comments for shaded/module packaging.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultTrustManagerFactoryProvider.java	Adds deprecation suppression for Provider ctor usage.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultJcaProvider.java	Registers signature services explicitly via constants; removes reflective algorithm lookup.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/JsonConverterUtil.java	Uses toJsonString() instead of writer plumbing; returns serialized JSON.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/HttpUtil.java	Core migration from Apache HttpClient to HttpURLConnection + new AIA handling.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/CertificateUtil.java	Simplifies X.509 chain conversion from generated certificates.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AiaCertificateChainUtil.java	Adds injectable AIA response loader; routes AIA downloads through it.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AccessTokenUtil.java	Removes Apache response types; uses header-only challenge retrieval; adds injectable POST seam.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/signature/KeyVaultKeylessRsaSsaPssSignature.java	Introduces ALGORITHM_NAME constant; simplifies provider registration.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/signature/KeyVaultKeylessRsaSignature.java	Minor formatting cleanup.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/signature/KeyVaultKeylessRsa512Signature.java	Introduces ALGORITHM_NAME constant.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/signature/KeyVaultKeylessRsa256Signature.java	Introduces ALGORITHM_NAME constant.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/signature/KeyVaultKeylessEcSha512Signature.java	Introduces ALGORITHM_NAME constant usage.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/signature/KeyVaultKeylessEcSha384Signature.java	Introduces ALGORITHM_NAME constant usage.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/signature/KeyVaultKeylessEcSha256Signature.java	Introduces ALGORITHM_NAME constant usage.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/KeyVaultClient.java	Adds overridable HTTP/auth seams; shifts to HttpUtil GET/POST wrappers.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/certificates/SpecificPathCertificates.java	Simplifies file enumeration and handles listFiles() returning null.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java	Adds constructor seam for injecting test KeyVaultClient; adjusts alias lookup logic.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/certificates/ClasspathCertificates.java	Simplifies resource listing helper and keeps path internal.
sdk/keyvault/azure-security-keyvault-jca/README.md	Updates docs and code snippets to use HttpsURLConnection examples.
sdk/keyvault/azure-security-keyvault-jca/pom.xml	Removes Apache HttpClient, SLF4J nop, Mockito-inline and related shaded relocations/bans.
sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md	Notes HttpClient-to-HttpURLConnection migration and dependency removal.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.