We are calling a REST api via HTTPS (api.smallinvoice.com).
The Server does present a valid SSL wildcard certificate for *.smallinvoice.com.

Seems like RestEasy does certificate validation by doing a DNS lookup an taking the hostname from the DNS response.
Problem is: api.smallinvoice.com is a CNAME for some other server (app1.lourenssystems.ch). That other domain does itself present a certificate that is for a third host (www.pingen.com).

IMHO, RestEasy should take the hostname or CNAME from the DNS response that matches the request url (api.smallinvoice.com in this case) and not the first name presented by the DNS server.

Problem seems not seem to be in the underlying Apache httpclient as using httpclient directly does not produce any errors, see attached test case.
(but maybe I'm using that httpclient wrong).