.add(server.hostName, pin(goodIntermediateCa.certificate))
        .build()
    val handshakeCertificates =
      HandshakeCertificates.Builder()
        .addTrustedCertificate(rootCa.certificate)
        .addTrustedCertificate(compromisedRootCa.certificate)
        .build()
    val client =
      clientTestRule.newClientBuilder()
        .sslSocketFactory(
          handshakeCertificates.sslSocketFactory(),

        .signedBy(serverCa)
        .addSubjectAlternativeName(server.hostName)
        .build()
    val serverHandshakeCertificates =
      HandshakeCertificates.Builder()
        .addTrustedCertificate(clientCa.certificate)
        .heldCertificate(serverCertificate)
        .build()
    server.useHttps(serverHandshakeCertificates.sslSocketFactory(), false)
    server.enqueue(MockResponse().setBody("abc"))

        .signedBy(serverCa)
        .addSubjectAlternativeName(server.hostName)
        .build()
    val serverHandshakeCertificates =
      HandshakeCertificates.Builder()
        .addTrustedCertificate(clientCa.certificate)
        .heldCertificate(serverCertificate)
        .build()
    server.useHttps(serverHandshakeCertificates.sslSocketFactory())
    server.enqueue(
      MockResponse.Builder()

  }

  private fun buildClient(
    heldCertificate: HeldCertificate?,
    vararg intermediates: X509Certificate,
  ): OkHttpClient {
    val builder =
      HandshakeCertificates.Builder()
        .addTrustedCertificate(serverRootCa.certificate)
    if (heldCertificate != null) {
      builder.heldCertificate(heldCertificate, *intermediates)
    }
    val handshakeCertificates = builder.build()

            .addSubjectAlternativeName("localhost")
            .rsa2048()
            .build()
        return@lazy HandshakeCertificates.Builder()
          .heldCertificate(heldCertificate)
          .addTrustedCertificate(heldCertificate.certificate)
          .build()
      }

      init {
        val platformSystemProperty = getPlatformSystemProperty()

        if (platformSystemProperty == JDK9_PROPERTY) {

    val heldCertificate: HeldCertificate = HeldCertificate.Builder().build()
    builder = builder.heldCertificate(heldCertificate, heldCertificate.certificate())
    builder = builder.addTrustedCertificate(heldCertificate.certificate())
  }

  @Test @Disabled
  fun heldCertificate() {
    val heldCertificate: HeldCertificate = HeldCertificate.Builder().build()

    dns["nonsan.com"] = serverIps
    dns["www.wildcard.com"] = serverIps
    dns["differentdns.com"] = listOf()
    val handshakeCertificates =
      HandshakeCertificates.Builder()
        .addTrustedCertificate(rootCa.certificate)
        .build()
    client =
      clientTestRule.newClientBuilder()
        .fastFallback(false) // Avoid data races.
        .dns(dns)
        .sslSocketFactory(

    val heldCertificate = HeldCertificate.Builder().build()
    builder = builder.heldCertificate(heldCertificate, heldCertificate.certificate)
    builder = builder.addTrustedCertificate(heldCertificate.certificate)
    builder = builder.addPlatformTrustedCertificates()
    val handshakeCertificates: HandshakeCertificates = builder.build()
  }

  @Test
  fun heldCertificate() {