val tlsEquipPlan = planWithCurrentOrInitialConnectionSpec(connectionSpecs, sslSocket)
        val connectionSpec = connectionSpecs[tlsEquipPlan.connectionSpecIndex]

        // Figure out the next connection spec in case we need a retry.
        retryTlsConnection = tlsEquipPlan.nextConnectionSpec(connectionSpecs, sslSocket)

        connectionSpec.apply(sslSocket, isFallback = tlsEquipPlan.isTlsFallback)

By default, OkHttp will attempt a `MODERN_TLS` connection.  However by configuring the client connectionSpecs you can allow a fall back to `COMPATIBLE_TLS` connection if the modern configuration fails.

```java
OkHttpClient client = new OkHttpClient.Builder()
    .connectionSpecs(Arrays.asList(ConnectionSpec.MODERN_TLS, ConnectionSpec.COMPATIBLE_TLS))
    .build();
```

  }

  @Test @Disabled
  fun connectionSpec() {
    val connectionSpec: ConnectionSpec = ConnectionSpec.RESTRICTED_TLS
    val tlsVersions: List<TlsVersion>? = connectionSpec.tlsVersions()
    val cipherSuites: List<CipherSuite>? = connectionSpec.cipherSuites()
    val supportsTlsExtensions: Boolean = connectionSpec.supportsTlsExtensions()
  }

  @Test @Disabled
  fun cookie() {

      builder.socketFactory(SSLSocketFactory.getDefault())
    }
  }

  @Test fun noSslSocketFactoryConfigured() {
    val client =
      OkHttpClient
        .Builder()
        .connectionSpecs(listOf(ConnectionSpec.CLEARTEXT))
        .build()
    assertFailsWith<IllegalStateException> {
      client.sslSocketFactory
    }
  }

  @Test fun nullHostileProtocolList() {
    val nullHostileProtocols =

#### Vars and Vals

Java doesn’t have language support for properties so developers make do with getters and setters.
Kotlin does have properties and we take advantage of them in OkHttp.

 * **Address**: certificatePinner, connectionSpecs, dns, hostnameVerifier, protocols, proxy,
   proxyAuthenticator, proxySelector, socketFactory, sslSocketFactory, url
 * **Cache**: directory

      certificatePinner = useCertificatePinner,
      proxyAuthenticator = proxyAuthenticator,
      proxy = proxy,
      protocols = call.client.protocols,
      connectionSpecs = call.client.connectionSpecs,
      proxySelector = proxySelector,
    )
  }

    this.client
      .newBuilder()
      .apply {
        if (connectionSpec != null) {
          connectionSpecs(
            listOf(
              ConnectionSpec
                .Builder(connectionSpec)
                .apply {
                  if (tlsVersion != null) {
                    tlsVersions(tlsVersion)
                  }
                  if (cipherSuites != null) {

          }
    }
  }
}

@SuppressSignatureCheck
class WiresharkExample(
  tlsVersions: List<TlsVersion>,
  private val launch: Launch? = null,
) {
  private val connectionSpec =
    ConnectionSpec
      .Builder(ConnectionSpec.RESTRICTED_TLS)
      .tlsVersions(*tlsVersions.toTypedArray())
      .build()

  private val eventListenerFactory =
    WireSharkListenerFactory(

      OverrideParam.RetryOnConnectionFailure -> {
        enableTls()
        var first = true
        client =
          client
            .newBuilder()
            .connectionSpecs(listOf(ConnectionSpec.RESTRICTED_TLS, ConnectionSpec.MODERN_TLS))
            .eventListener(
              object : EventListener() {
                override fun secureConnectEnd(
                  call: Call,

  internal fun planConnectToRoute(
    route: Route,
    routes: List<Route>? = null,
  ): ConnectPlan {
    if (route.address.sslSocketFactory == null) {
      if (ConnectionSpec.CLEARTEXT !in route.address.connectionSpecs) {
        throw UnknownServiceException("CLEARTEXT communication not enabled for client")
      }

      val host = route.address.url.host