.serialNumber(1L)
        .certificateAuthority(2)
        .build()
    val certA =
      HeldCertificate.Builder()
        .serialNumber(2L)
        .certificateAuthority(1)
        .signedBy(root)
        .build()
    val certB =
      HeldCertificate.Builder()
        .serialNumber(3L)
        .certificateAuthority(0)
        .signedBy(certA)
        .build()
    val certC =

    platform.assumeNotConscrypt()
    platform.assumeNotBouncyCastle()

    val clientRoot =
      HeldCertificate.Builder()
        .certificateAuthority(1)
        .build()
    val clientIntermediate =
      HeldCertificate.Builder()
        .certificateAuthority(0)
        .signedBy(clientRoot)
        .build()
    val clientCertificate =
      HeldCertificate.Builder()
        .signedBy(clientIntermediate)

We use `certificateAuthority(int)` to create certificates that can sign other certificates. The
int specifies how many intermediate certificates are allowed beneath it in the chain.

```java
HeldCertificate rootCertificate = new HeldCertificate.Builder()
    .certificateAuthority(1)
    .build();

HeldCertificate intermediateCertificate = new HeldCertificate.Builder()

import okhttp3.tls.HeldCertificate
import org.junit.jupiter.api.Test

class HandshakeTest {
  val serverRoot =
    HeldCertificate.Builder()
      .certificateAuthority(1)
      .build()
  val serverIntermediate =
    HeldCertificate.Builder()
      .certificateAuthority(0)
      .signedBy(serverRoot)
      .build()
  val serverCertificate =
    HeldCertificate.Builder()
      .signedBy(serverIntermediate)
      .build()

	public fun <init> ()V
	public final fun addSubjectAlternativeName (Ljava/lang/String;)Lokhttp3/tls/HeldCertificate$Builder;
	public final fun build ()Lokhttp3/tls/HeldCertificate;
	public final fun certificateAuthority (I)Lokhttp3/tls/HeldCertificate$Builder;
	public final fun commonName (Ljava/lang/String;)Lokhttp3/tls/HeldCertificate$Builder;
	public final fun duration (JLjava/util/concurrent/TimeUnit;)Lokhttp3/tls/HeldCertificate$Builder;

	}

	// Log with redaction
	if err := api.RedactSecrets(kcfg); err != nil {
		return kubeconfig{}, err
	}
	for _, c := range kcfg.Clusters {
		// Not actually sensitive, just annoyingly verbose.
		c.CertificateAuthority = "REDACTED"
	}
	lrcfg, err := latest.Scheme.ConvertToVersion(kcfg, latest.ExternalVersion)
	if err != nil {
		return kubeconfig{}, err
	}
	redacted, err := yaml.Marshal(lrcfg)
	if err != nil {