.containsExactly(TlsVersion.TLS_1_2)
    assertThat(tlsSpec.supportsTlsExtensions).isTrue()
  }

  @Test
  fun tls_defaultCiphers_noFallbackIndicator() {
    platform.assumeNotConscrypt()
    platform.assumeNotBouncyCastle()
    val tlsSpec =
      ConnectionSpec
        .Builder(true)
        .tlsVersions(TlsVersion.TLS_1_2)
        .supportsTlsExtensions(false)
        .build()

  }

  @Test
  fun testDefaultHandshakeCipherSuiteOrderingTls12Restricted() {
    // We are avoiding making guarantees on ordering of secondary Platforms.
    platform.assumeNotConscrypt()
    platform.assumeNotBouncyCastle()

    val client = makeClient(ConnectionSpec.RESTRICTED_TLS, TlsVersion.TLS_1_2)

    val handshake = makeRequest(client)

    }

    fun assumeAndroid() {
      assumeTrue(Platform.isAndroid)
    }

    fun assumeGraalVMImage() {
      assumeTrue(isGraalVMImage())
    }

    fun assumeNotConscrypt() {
      assumeTrue(getPlatformSystemProperty() != CONSCRYPT_PROPERTY)
    }

    fun assumeNotJdk9() {
      assumeTrue(getPlatformSystemProperty() != JDK9_PROPERTY)
    }

    assertThat(handshake.peerPrincipal).isNull()
    assertThat(handshake.peerCertificates.size).isEqualTo(0)
  }

  @Test
  fun httpsWithClientAuth() {
    platform.assumeNotBouncyCastle()
    platform.assumeNotConscrypt()
    val clientCa =
      HeldCertificate
        .Builder()
        .certificateAuthority(0)
        .build()
    val serverCa =
      HeldCertificate
        .Builder()

    assertThat(handshake.peerPrincipal).isNull()
    assertThat(handshake.peerCertificates.size).isEqualTo(0)
  }

  @Test
  fun httpsWithClientAuth() {
    platform.assumeNotBouncyCastle()
    platform.assumeNotConscrypt()

    val clientCa =
      HeldCertificate
        .Builder()
        .certificateAuthority(0)
        .build()
    val serverCa =
      HeldCertificate
        .Builder()

    assertThat(verifier.verify("tel.com", session)).isFalse()
    assertThat(verifier.verify("k.com", session)).isFalse()
  }

  @Test fun specialKInExternalCert() {
    // OpenJDK related test.
    platform.assumeNotConscrypt()

    // Expecting actual:
    //  ["℡.com", "K.com"]
    // to contain exactly (and in same order):
    //  ["���.com", "���.com"]
    platform.assumeNotBouncyCastle()

    // $ cat ./cert.cnf