if (openJSSE != null) {
          return openJSSE
        }
      }

      // An Oracle JDK 9 like OpenJDK, or JDK 8 251+.
      val jdk9 = Jdk9Platform.buildIfSupported()

      if (jdk9 != null) {
        return jdk9
      }

      // An Oracle JDK 8 like OpenJDK, pre 251.
      val jdkWithJettyBoot = Jdk8WithJettyBootPlatform.buildIfSupported()

      call.execute()
    }.also { expected ->
      when (expected) {
        is SSLHandshakeException -> {
          // JDK 11+
        }
        is SSLException -> {
          // javax.net.ssl.SSLException: readRecord
        }
        is SocketException -> {
          // Conscrypt, JDK 8 (>= 292), JDK 9
        }
        else -> {
          assertThat(expected.message).isEqualTo("exhausted all routes")
        }

  @Test
  fun disconnectAtStart() {
    server.enqueue(
      MockResponse()
        .setSocketPolicy(SocketPolicy.DISCONNECT_AT_START),
    )
    server.enqueue(MockResponse()) // The jdk's HttpUrlConnection is a bastard.
    server.enqueue(MockResponse())
    try {
      server.url("/a").toUrl().openConnection().getInputStream()
      fail<Any>()
    } catch (expected: IOException) {
    }

      }

    fun fromMajor(version: Int): Matcher<PlatformVersion> {
      return object : TypeSafeMatcher<PlatformVersion>() {
        override fun describeTo(description: Description) {
          description.appendText("JDK with version from $version")
        }

        override fun matchesSafely(item: PlatformVersion): Boolean {
          return item.majorVersion >= version
        }
      }
    }

    its own IDN mapping table in the library.

 *  New: Prefer the client's configured precedence order for TLS cipher suites. (OkHttp used to
    prefer the JDK’s precedence order.) This change may cause your HTTP calls to negotiate a
    different cipher suite than before! OkHttp's defaults cipher suites are selected for good
    security and performance.

 * here. Cipher suites that are not available on either Android (through API level 24) or Java
 * (through JDK 9) are omitted for brevity.
 *
 * See [Android SSLEngine][sslengine] which lists the cipher suites supported by Android.
 *
 * See [JDK Providers][oracle_providers] which lists the cipher suites supported by Oracle.
 *

          fetch-depth: 0

      - name: Install Old JDK 8
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 8.0.242

      - name: Configure JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 11

      - name: Configure JDK
        uses: actions/setup-java@v4
        with:

    // java.security.KeyStoreException: Certificate chain is not valid
    // at sun.security.pkcs12.PKCS12KeyStore.setKeyEntry
    // http://openjdk.java.net/jeps/229
    // http://hg.openjdk.java.net/jdk9/jdk9/jdk/file/2c1c21d11e58/src/share/classes/sun/security/pkcs12/PKCS12KeyStore.java#l596
    val keystoreType = if (platform.isJdk9()) "JKS" else null
    val x509KeyManager = newKeyManager(keystoreType, heldCertificate, *intermediates)

  @Test
  fun disconnectAtStart() {
    server.enqueue(
      MockResponse.Builder()
        .socketPolicy(DisconnectAtStart)
        .build(),
    )
    server.enqueue(MockResponse()) // The jdk's HttpUrlConnection is a bastard.
    server.enqueue(MockResponse())
    try {
      server.url("/a").toUrl().openConnection().getInputStream()
      fail<Unit>()
    } catch (expected: IOException) {