throw e
      }

      null
    }
  }

  /**
   * Configure TLS extensions on `sslSocket` for `route`.
   */
  open fun configureTlsExtensions(
    sslSocket: SSLSocket,
    hostname: String?,
    protocols: List<@JvmSuppressWildcards Protocol>,
  ) {
  }

  /** Called after the TLS handshake to release resources allocated by [configureTlsExtensions]. */

    consistent with the length of the response body.

 *  Fix: Don't crash when converting a `HttpUrl` instance with an unresolvable hostname to a URI.
    The new behavior strips invalid characters like `"` and `{` from the hostname before converting.

 *  Fix: Undo a performance regression introduced in OkHttp 4.0 caused by differences in behavior

   */
  var noNewExchanges = false

  /**
   * If true, this connection may not be used for coalesced requests. These are requests that could
   * share the same connection without sharing the same hostname.
   */
  private var noCoalescedConnections = false

  /**
   * The number of times there was a problem establishing a stream that could be due to route
   * chosen. Guarded by this.
   */

  fun check(
    hostname: String,
    vararg peerCertificates: Certificate,
  ) {
    check(hostname, peerCertificates.toList())
  }

  /**
   * Returns list of matching certificates' pins for the hostname. Returns an empty list if the
   * hostname does not have pinned certificates.
   */
  fun findMatchingPins(hostname: String): List<Pin> = pins.filterList { matchesHostname(hostname) }

    val clientCertificates =
      HandshakeCertificates.Builder()
        .addPlatformTrustedCertificates()
        .apply {
          if (Build.VERSION.SDK_INT >= 24) {
            addInsecureHost(server.hostName)
          }
        }
        .build()

    client =
      client.newBuilder()
        .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager)
        .build()

     * a literal IP address, or a hostname pattern. If no subject alternative names are added that
     * extension will be omitted.
     */
    fun addSubjectAlternativeName(altName: String) =
      apply {
        altNames += altName
      }

    /**
     * Set this certificate's common name (CN). Historically this held the hostname of TLS

        .build()
    serverCert =
      HeldCertificate.Builder()
        .signedBy(serverIntermediateCa)
        .serialNumber(3L)
        .commonName("Local Host")
        .addSubjectAlternativeName(server.hostName)
        .build()
    clientRootCa =
      HeldCertificate.Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .commonName("root")
        .addSubjectAlternativeName("root_ca.com")

    server.shutdown()
  }

  @Test
  fun portImplicitlyStarts() {
    assertThat(server.port).isGreaterThan(0)
  }

  @Test
  fun hostnameImplicitlyStarts() {
    assertThat(server.hostName).isNotNull()
  }

  @Test
  fun toProxyAddressImplicitlyStarts() {
    assertThat(server.toProxyAddress()).isNotNull()
  }

  @Test
  fun differentInstancesGetDifferentPorts() {

            """
            |Hostname ${address.url.host} not verified:
            |    certificate: ${CertificatePinner.pin(cert)}
            |    DN: ${cert.subjectDN.name}
            |    subjectAltNames: ${OkHostnameVerifier.allSubjectAltNames(cert)}
            """.trimMargin(),
          )
        } else {
          throw SSLPeerUnverifiedException(
            "Hostname ${address.url.host} not verified (no certificates)",

   * https://github.com/square/okhttp/issues/5770
   */
  @Test fun proxySelectorNotCalledForNullHost() {
    // The string '>' is okay in a hostname in HttpUrl, which does very light hostname validation.
    // It is not okay in URI, and so it's stripped and we get a URI with a null host.
    val bogusHostname = ">"
    val address =
      factory.newAddress(