Java 17 HttpClient TLS Validation Tightening After Java 11 Broad Acceptance

Java 17 HttpClient defaults now enforce strict TLS certificate validation, requiring explicit trustStore configuration where Java 11 allowed broader chain acceptance. This version transition creates a compatibility boundary for services migrating across JDK releases without modifying trust material. The precise goal is to determine the minimal trustStore configuration that preserves certificate chain acceptance under Java 17+ HttpClient defaults while avoiding unintended restrictions on valid certificates. Relevant constraints include uncertainty around whether the JVM system trust store is automatically consulted, how trustStore type JKS versus PKCS12 affects validation scope, and whether the accompanying TLS 1.3 preference shift in HttpsURLConnection impacts servers limited to TLS 1.2 negotiation. These unresolved behaviors affect deployment pipelines that rely on automated certificate rotation and intermediate CA chains.

What trustStore type and configuration minimal set satisfies Java 17+ HttpClient strict validation without relying on system defaults? How does the TLS 1.3 preference shift interact with servers that only negotiate TLS 1.2 in production? Does Java 21 HttpClient's DNS timeout fallback to /etc/hosts override custom resolver configurations when the timeout exceeds 5 seconds?