sslSocketFactory: SSLSocketFactory?,
    x509TrustManager: X509TrustManager?,
  ): Interceptor.Chain {
    check(exchange == null) { "sslSocketFactory can't be adjusted in a network interceptor" }

    if (sslSocketFactory != null && x509TrustManager != null) {
      val newCertificateChainCleaner = CertificateChainCleaner.get(x509TrustManager)
      return copy(
        sslSocketFactory = sslSocketFactory,

    }

    object X509TrustManagerOverride : Override<X509TrustManager?> {
      override val paramName: String = "sslSocketFactory"

      override fun Interceptor.Chain.value(): X509TrustManager? = x509TrustManagerOrNull

      override fun Interceptor.Chain.withOverride(value: X509TrustManager?): Interceptor.Chain =
        withSslSocketFactory(Platform.get().newSslSocketFactory(value!!), value)

      }

      private fun trustManagerForCertificates(inputStream: InputStream): X509TrustManager {
        ... // Full source omitted. See sample.
      }
    ```
=== ":material-language-java: Java"
    ```java
      private final OkHttpClient client;

      public CustomTrust() {
        X509TrustManager trustManager;
        SSLSocketFactory sslSocketFactory;
        try {

import java.util.logging.Logger
import javax.net.ssl.HostnameVerifier
import javax.net.ssl.SSLPeerUnverifiedException
import javax.net.ssl.SSLSocket
import javax.net.ssl.TrustManagerFactory
import javax.net.ssl.X509TrustManager
import mockwebserver3.MockResponse
import mockwebserver3.MockWebServer
import mockwebserver3.junit5.StartStop
import okhttp3.Cache
import okhttp3.Call
import okhttp3.CallEvent.CallEnd

  }

  /**
   * Won't coalesce if we can't clean certs e.g. a dev setup.
   */
  @Test
  fun redirectWithDevSetup() {
    val trustManager: X509TrustManager =
      object : X509TrustManager {
        override fun checkClientTrusted(
          x509Certificates: Array<X509Certificate>,
          s: String,
        ) {
        }

        override fun checkServerTrusted(

import javax.net.SocketFactory
import javax.net.ssl.HostnameVerifier
import javax.net.ssl.SSLSocket
import javax.net.ssl.SSLSocketFactory
import javax.net.ssl.X509KeyManager
import javax.net.ssl.X509TrustManager
import okhttp3.logging.HttpLoggingInterceptor
import okhttp3.mockwebserver.MockResponse
import okhttp3.mockwebserver.MockWebServer
import okhttp3.mockwebserver.PushPromise
import okhttp3.mockwebserver.RecordedRequest

    // again with a different route.
    if (e is SSLHandshakeException) {
      // If the problem was a CertificateException from the X509TrustManager,
      // do not retry.
      if (e.cause is CertificateException) {
        return false
      }
    }
    if (e is SSLPeerUnverifiedException) {
      // e.g. a certificate pinning error.

import javax.net.ServerSocketFactory
import javax.net.ssl.SSLContext
import javax.net.ssl.SSLSocket
import javax.net.ssl.SSLSocketFactory
import javax.net.ssl.TrustManager
import javax.net.ssl.X509TrustManager
import mockwebserver3.SocketEffect.CloseSocket
import mockwebserver3.SocketEffect.CloseStream
import mockwebserver3.SocketEffect.ShutdownConnection
import mockwebserver3.SocketEffect.Stall

    assertThat(a.x509TrustManager).isNotNull()

    // Multiple clients share the instances.
    val b = client.newBuilder().build()
    assertThat(b.dispatcher).isSameInstanceAs(a.dispatcher)
    assertThat(b.connectionPool).isSameInstanceAs(a.connectionPool)
    assertThat(b.sslSocketFactory).isSameInstanceAs(a.sslSocketFactory)
    assertThat(b.x509TrustManager).isSameInstanceAs(a.x509TrustManager)
  }

    proxy selection process.
 *  New: `Response.byteString()` reads the entire response into memory as a byte string.
 *  New: `OkHttpClient.x509TrustManager` accessor.
 *  New: Permit [new WebSocket response codes][iana_websocket]: 1012 (Service Restart), 1013 (Try
    Again Later), and 1014 (invalid response from the upstream).