Add setEnabledCipherSuites option to OTLP exporter builders

[raheelshahzad]

Resolves #8558 via the standalone-setter approach suggested there, instead of a generic SSLParameters setter.

What

Adds setEnabledCipherSuites(List<String>) to the OTLP exporter builders (HTTP and gRPC; traces, metrics, logs, profiles), mirroring setEnabledProtocols from #8610 file for file:

• HttpSenderConfig / GrpcSenderConfig gain a nullable getEnabledCipherSuites() default method.
• JdkHttpSender applies it via SSLParameters.setCipherSuites.
• OkHttpHttpSender / OkHttpGrpcSender apply it via ConnectionSpec.Builder.cipherSuites.
• When both protocols and cipher suites are configured they now share a single SSLParameters / ConnectionSpec rather than the second overwriting the first.
• The upstream gRPC managed-channel sender is left unchanged, as for protocols.

Cipher suite names follow the JSSE convention (TLS_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, ...). Null and empty lists are rejected at the public builder boundary.

Testing

• AbstractHttpTelemetryExporterTest / AbstractGrpcTelemetryExporterTest: positive export with an explicit cipher suite list, and a negative case restricting the client to an ECDSA-only suite against the RSA test server, which fails the handshake as expected. The negative case is skipped for UpstreamGrpcSenderProvider, matching the protocols test.
• Builder validation and toString coverage extended alongside the protocols assertions.
• JdkHttpSenderTest: asserts protocols and cipher suites both land on the built HttpClient's SSLParameters.
• ./gradlew check passes on :sdk:common, :exporters:otlp:all, :exporters:otlp:profiles, :exporters:otlp:testing-internal, :exporters:sender:jdk, :exporters:sender:okhttp. API diff files regenerated.

🤖 Generated with Claude Code

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: raheelshahzad / name: raheelshahzad (1a3bcb7)

[otelbot]

⚠️ API changes detected — additional maintainer review required

@jack-berg @jkwatson

This PR modifies the public API surface area of the following module(s):

• opentelemetry-exporter-otlp
• opentelemetry-sdk-common

Please review the changes in docs/apidiffs/current_vs_latest/ carefully before approving.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on the author · refreshed 2026-09-24 21:33 UTC

Respond to 1 review item (e.g. link a commit, explain why not, ask a follow-up):

• Top-level threads: 1

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Should this be with reviewers? Comment /dashboard route:reviewers to route it to them.
• Anything wrong — including the routing? Report it with what you expected; it helps us improve the dashboard.

[codecov]

Codecov Report

❌ Patch coverage is 90.66667% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.44%. Comparing base (f73e837) to head (ddb54b5).
⚠️ Report is 5 commits behind head on main.

Files with missing lines	Patch %	Lines
...ry/exporter/sender/jdk/internal/JdkHttpSender.java	71.42%	0 Missing and 2 partials ⚠️
...orter/sender/okhttp/internal/OkHttpGrpcSender.java	81.81%	0 Missing and 2 partials ⚠️
...orter/sender/okhttp/internal/OkHttpHttpSender.java	81.81%	0 Missing and 2 partials ⚠️
...ntelemetry/sdk/common/export/HttpSenderConfig.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #8858      +/-   ##
============================================
- Coverage     91.44%   91.44%   -0.01%     
- Complexity    10667    10702      +35     
============================================
  Files          1007     1007              
  Lines         28686    28740      +54     
  Branches       3676     3695      +19     
============================================
+ Hits          26233    26282      +49     
- Misses         1657     1658       +1     
- Partials        796      800       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[raheelshahzad]

/easycla

[jack-berg]

I was working on this last week and concluded that we need setEnabledTlsNamedGroups rather than setEnabledCipherSuites as mentioned in the issue. My commit is here: jack-berg@55326a1

I hadn't opened a PR yet in an attempt to limit WIP.

Setting cipher suites may have utility, but I dont think it solves the mentioned issue.