The SSLSocketFactory.getDefault() method is declared to return a SocketFactory, but it actually returns an SSLSocketFactory. Similarly, the SSLSocketFactory.createSocket(...) methods are declared to return Sockets, but they actually return SSLSockets.

All these cases are inconvenient, forcing the user of these methods to cast the result to the subtype if they want access to the SSLSocketFactory-specific methods such as getDefaultCipherSuites(), or similarly for the various SSLSocket-specific methods.

Consider changing the return types of these three methods to the more precise subtypes, so that casts are no longer required. This would be a binary-compatible change.