How would you configure HttpClient to trust a custom or self-signed SSL/TLS certificate for testing against an internal service, and what security risks does disabling certificate validation entirely introduce?

HttpClient.newBuilder().sslContext(customSslContext) lets you supply a custom SSLContext configured with a TrustManager trusting your specific self-signed certificate (or an entire custom certificate authority), the correct, security-conscious approach for legitimately trusting a specific known certificate; a common but dangerous shortcut sometimes seen in test code involves an SSLContext configured with a TrustManager that accepts ANY certificate unconditionally, which -- as covered earlier regarding HttpClient's outbound certificate validation -- completely defeats TLS's security guarantees and must never be used in production code, since it makes the connection vulnerable to man-in-the-middle interception despite superficially appearing to use HTTPS.

// Correct approach: trust a SPECIFIC known certificate via a properly configured TrustManager
KeyStore trustStore = KeyStore.getInstance("PKCS12");
trustStore.load(new FileInputStream("custom-truststore.p12"), "password".toCharArray());
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(trustStore);
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, tmf.getTrustManagers(), null);

HttpClient client = HttpClient.newBuilder().sslContext(sslContext).build();