throw KeyStoreException("unable to support unencodable private key")
      }

      val keyManager = newKeyManager(null, heldCertificate, *(intermediates ?: emptyArray()))
      val trustManager = newTrustManager(null, trustedCertificates, immutableInsecureHosts)
      return HandshakeCertificates(keyManager, trustManager)
    }
  }