tl;dr:

suspend fun main() {
    val client = HttpClient(Java)
    val response1 = client.get("<https://sha256.badssl.com/>")
    println(response1.status)
    val response2 = client.get("<https://untrusted-root.badssl.com/>")
    println(response2.status)
}

prints

200 OK
200 OK

😬 Even though the second URL doesn’t have a valid certificate.

It works as expected (i.e. first request succeeds; second request fails) with the Apache engine. It also works as expected when using a freshly-created HttpClient for each request (as mentioned in the StackOverflow post)

I created https://youtrack.jetbrains.com/issue/KTOR-5495. I can add more info if needed. I have limited the visibility for now since this may be a security vulnerability.