Alright, so, this is not a bug, although it does look wonky. What's going on is `org.apache.http.conn.ssl.SSLSocketFactory` is only used here to load the `STRICT_HOSTNAME_VERIFIER`, which is an instance of `org.apache.http.conn.ssl.X509HostnameVerifier`. This in turn implements the interface `javax.net.ssl.HostnameVerifier`. I think this code is correct as is.