Here;s a new little classpath issue for people: https://issues.apache.org/jira/browse/HADOOP-18159
All copies of httpclient, including shaded ones in libraries used by the s3a, gs and cos cloud connectors, turn out to load their TLD list from the same resource mozilla/public-suffix-list.txt If the version that is loaded is sufficiently out of date, is TLS connections to object store endpoints may fail. We are lucky that André Fonseca put in the efforts to track this down... We had some internal suspicion that removing the hadoop-cos dependency made this problem "Go away" but couldn't understand why given that both libraries were shaded. Now we know. Who is set up to test the hadoop-cos cloud connector? Because I've just changed its dependencies without doing the strict regression testing. And, as I am yet to kick off that 3.3.4 build but I want to get this change into it. Can anyone help with testing here? Finally, and this is for future work. What do we do to stop this problem coming back? As it will, won't it?