This should be done as soon as the developer specifies a SSLContext or a TrustStore so with all the ConnectionFactory#useSslProtocol methods, except ConnectionFactory#useSslProtocol() and ConnectionFactory#useSslProtocol(String protocol) methods, where server checks are explicitly relaxed by using the TrustEverythingTrustManager.

Disabling server hostname verification could issue a warning, just like when using TrustEverythingTrustManager.