if !ok {
		t.Errorf("expected net.Error; got %#v", err)
		return
	}
	if !ne.Timeout() {
		t.Errorf("expected timeout error; got %v", err)
	}
	if !strings.Contains(err.Error(), "handshake timeout") {
		t.Errorf("expected 'handshake timeout' in error; got %v", err)
	}
}

// Trying to repro golang.org/issue/3514
func TestTLSServerClosesConnection(t *testing.T) {

...

    val cipherSuite = response1.handshake!!.cipherSuite
    val localCerts = response1.handshake!!.localCertificates
    val serverCerts = response1.handshake!!.peerCertificates
    val peerPrincipal = response1.handshake!!.peerPrincipal
    val localPrincipal = response1.handshake!!.localPrincipal
    val response2 = client.newCall(request).execute() // Cached!

HSPLokhttp3/EventListener;->secureConnectEnd(Lokhttp3/Call;Lokhttp3/Handshake;)V
HSPLokhttp3/EventListener;->secureConnectStart(Lokhttp3/Call;)V
HSPLokhttp3/Handshake$Companion$handshake$1;-><init>(Ljava/util/List;)V
HSPLokhttp3/Handshake$peerCertificates$2;-><init>(Lkotlin/jvm/functions/Function0;)V
HSPLokhttp3/Handshake;-><init>(Lokhttp3/TlsVersion;Lokhttp3/CipherSuite;Ljava/util/List;Lkotlin/jvm/functions/Function0;)V

        TlsVersion.TLS_1_3,
      ) // v1.2 on OpenJDK 8.
    val request1 = server.takeRequest()
    assertThat(tlsVersions).contains(request1.handshake?.tlsVersion)
    val request2 = server.takeRequest()
    assertThat(tlsVersions).contains(request2.handshake?.tlsVersion)
  }

  /**
   * Verify that we don't retry connections on certificate verification errors.
   *

        .build()
    val request2 = Request.Builder().url(server.url("/")).build()
    val response2 = client.newCall(request2).execute()
    assertThat(response1.handshake).isNotSameAs(
      response2.handshake,
    )
    response2.body.close()
  }

  @Test
  fun unmatchingPinnedCertificate() {
    enableTls()
    server.enqueue(MockResponse())

			ts.Config.WriteTimeout = timeout
			t.Logf("Server.Config.WriteTimeout = %v", timeout)
		})

		// The server's WriteTimeout parameter also applies to reads during the TLS
		// handshake. The client makes the last write during the handshake, and if
		// the server happens to time out during the read of that write, the client
		// may think that the connection was accepted even though the server thinks
		// it timed out.
		//

	"hand":                                 "\u270b",
	"hand_over_mouth":                      "\U0001f92d",
	"handbag":                              "\U0001f45c",
	"handball_person":                      "\U0001f93e",
	"handshake":                            "\U0001f91d",
	"hankey":                               "\U0001f4a9",
	"hash":                                 "#\ufe0f\u20e3",
	"hatched_chick":                        "\U0001f425",

}

func (srv *Server) initialReadLimitSize() int64 {
	return int64(srv.maxHeaderBytes()) + 4096 // bufio slop
}

// tlsHandshakeTimeout returns the time limit permitted for the TLS
// handshake, or zero for unlimited.
//
// It returns the minimum of any positive ReadHeaderTimeout,
// ReadTimeout, or WriteTimeout.
func (srv *Server) tlsHandshakeTimeout() time.Duration {
	var ret time.Duration

connections to this port should be secured using TLS. enum: - DISABLE - SIMPLE - MUTUAL - ISTIO_MUTUAL type: string privateKey: description: REQUIRED if mode is `MUTUAL`. type: string sni: description: SNI string to present to the server during TLS handshake. type: string subjectAltNames: description: A list of alternate names to verify the subject identity in the certificate. items: type: string type: array type: object type: object type: array proxyProtocol: description: The upstream PROXY protocol...