The root cause of the CI failure was that the old code's SSLContext.setDefault() silently weakened TLS for the entire JVM, and the

  test's readContent was unknowingly piggy-backing on that global relaxation. After the hardening fix, readContent now does its own    per-connection trust-all + hostname-verifier override (same pattern as the production fix), so the test no longer depends on JVM-wide
  state. This also makes the test an implicit regression guard: if someone reintroduces SSLContext.setDefault() in the reporter, nothing
   in the test relies on it.

Author: rzo1

external/storm-metrics-prometheus/src/test/java/org/apache/storm/metrics/prometheus/PrometheusPreparableReporterTest.java

@@ -22,11 +22,17 @@
 import org.testcontainers.junit.jupiter.Testcontainers;
 import org.testcontainers.utility.MountableFile;
 
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.net.HttpURLConnection;
 import java.net.URL;
+import java.security.GeneralSecurityException;
+import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.Base64;
 import java.util.HashSet;
@@ -163,6 +169,31 @@ private void assertMetrics(List<String> elements, String endpoint, Map<String, O
     private String readContent(String url, Map<String, Object> conf) throws IOException {
         final URL obj = new URL(url);
         final HttpURLConnection con = (HttpURLConnection) obj.openConnection();
+        if (con instanceof HttpsURLConnection) {
+            // The test PushGateway uses a self-signed certificate. Scope the trust-all
+            // SSLContext to this connection only, so we do not mutate JVM-wide TLS state.
+            try {
+                final SSLContext sslContext = SSLContext.getInstance("TLS");
+                sslContext.init(null, new TrustManager[]{new X509TrustManager() {
+                    @Override
+                    public X509Certificate[] getAcceptedIssuers() {
+                        return new X509Certificate[0];
+                    }
+
+                    @Override
+                    public void checkClientTrusted(X509Certificate[] chain, String authType) {
+                    }
+
+                    @Override
+                    public void checkServerTrusted(X509Certificate[] chain, String authType) {
+                    }
+                }}, null);
+                ((HttpsURLConnection) con).setSSLSocketFactory(sslContext.getSocketFactory());
+                ((HttpsURLConnection) con).setHostnameVerifier((h, s) -> true);
+            } catch (GeneralSecurityException e) {
+                throw new IOException(e);
+            }
+        }
         con.setRequestMethod("GET");
 
         if (conf.containsKey("storm.daemon.metrics.reporter.plugin.prometheus.basic_auth_user")) {