I need to connect to an HTTPS endpoint with a bogus certificate, and the best way to achieve that is to subtype XmlRpcClient and tweak the logic of openConnection.
But XmlRpcClient is written in a way that basically makes it impossible to do subtyping. It would be great if several key fields and methods are made protected to enable my use case.
This is unnecessary. It's easy enough to build a custom security context (With your cert in a custom keystore) and set the default security context to your custom one. Since XmlRpcClient uses standard Java Http libraries, it uses the Java security contexts.
Sure, if you are willing to alter the VM-wide state, yes. But I don't want to do that.