From a72be7727b74f80f87e9dfaa926a044bb4e571ea Mon Sep 17 00:00:00 2001
From: Akash Kumar <116457960+akashchamp@users.noreply.github.com>
Date: Thu, 24 Sep 2026 21:33:04 +0530
Subject: [PATCH] [CALCITE-5896] Document TLS client certificate JDBC URL
 options

The client reference page documents truststore, truststore_password,
and keystore_type, which cover server-certificate verification, but
omits the keystore, keystore_password, and key_password JDBC URL
properties. CommonsHttpClientPoolCache uses these three to load the
client's own key material (loadKeyMaterial) for mutual TLS (mTLS)
client certificate authentication, and BuiltInConnectionProperty has
declared them since CALCITE-2285.

Add entries for keystore, keystore_password, and key_password,
mirroring the format of the existing truststore/keystore_type
entries.
---
 site/_docs/client_reference.md | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/site/_docs/client_reference.md b/site/_docs/client_reference.md
index c88199475a..2a953d79a2 100644
--- a/site/_docs/client_reference.md
+++ b/site/_docs/client_reference.md
@@ -185,6 +185,37 @@ on-hover images for the permalink, but oh well.
 
 : _Required_: No.
 
+<strong><a name="keystore" href="#keystore">keystore</a></strong>
+
+: _Description_: A path to a Java KeyStore (JKS) file on the local filesystem
+  which contains the client's private key and certificate to present during
+  a TLS handshake for mutual TLS (mTLS) client certificate authentication.
+  Only necessary when the Avatica server requires clients to authenticate
+  with a certificate.
+
+: _Default_: `null`.
+
+: _Required_: No.
+
+<strong><a name="keystore_password" href="#keystore_password">keystore_password</a></strong>
+
+: _Description_: The password for the Java KeyStore file specified by <a href="#keystore">keystore</a>.
+
+: _Default_: `null`.
+
+: _Required_: Only if `keystore` was provided.
+
+<strong><a name="key_password" href="#key_password">key_password</a></strong>
+
+: _Description_: The password that protects the private key entry inside the
+  Java KeyStore file specified by <a href="#keystore">keystore</a>. This may
+  differ from <a href="#keystore_password">keystore_password</a> depending on
+  how the keystore was created.
+
+: _Default_: `null`.
+
+: _Required_: Only if `keystore` was provided.
+
 <strong><a name="fetch_size" href="#fetch_size">fetch_size</a></strong>
 
 : _Description_: The number of rows to fetch. If