The current internals are based on the Apache http libraries < 4.3 and we are now at 4.4+ For one thing, specification changes now mean we are getting annoying warnings on cookies from certain servers (which even worse, cannot seem to be suppressed) since that spec changed and we don't follow the updated spec. The problem with updating HttpClient is that we need custom SSL sockets with our trust manager and that really can't be side-stepped. There is a way to do this with 4.4, but it is not obvious and in any case, should not be undertaken lightly.