Nonetheless, A is "closer" inside the dependency tree, so Maven works by using C 1.0 for each A and B and doesn't even alert you concerning this (It can be pretty astounding to me); Not particularly a setting but you can override the default TrustManager and HostnameVerifier to just