HandshakeCertificates clientCertificates = new HandshakeCertificates.Builder()
        .addTrustedCertificate(localhostCertificate.certificate())
        .build();
    OkHttpClient client = new OkHttpClient.Builder()
        .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager())
        .build();

    Call call = client.newCall(new Request.Builder()
        .url(server.url("/"))

```java
Request washingtonPostRequest = new Request.Builder()
    .url("https://www.washingtonpost.com/")
    .build();
client.newCall(washingtonPostRequest).enqueue(new Callback() {
  ...
});

Request newYorkTimesRequest = new Request.Builder()
    .url("https://www.nytimes.com/")
    .build();
client.newCall(newYorkTimesRequest).enqueue(new Callback() {
  ...
});
```

  // Create a MockWebServer. These are lean enough that you can create a new
  // instance for every unit test.
  MockWebServer server = new MockWebServer();

  // Schedule some responses.
  server.enqueue(new MockResponse().setBody("hello, world!"));
  server.enqueue(new MockResponse().setBody("sup, bra?"));
  server.enqueue(new MockResponse().setBody("yo dog"));

  // Start the server.
  server.start();

    This artifact has a dependency on Google's Brotli decoder (95 KiB).

 *  New: `EventListener.proxySelectStart()`, `proxySelectEnd()` events give visibility into the
    proxy selection process.
 *  New: `Response.byteString()` reads the entire response into memory as a byte string.
 *  New: `OkHttpClient.x509TrustManager` accessor.
 *  New: Permit [new WebSocket response codes][iana_websocket]: 1012 (Service Restart), 1013 (Try

    UnixSocketChannel channel = UnixSocketChannel.open();
    return new TunnelingUnixSocket(path, channel);
  }

  @Override public Socket createSocket(String host, int port) throws IOException {
    Socket result = createSocket();

    try {
      result.connect(new InetSocketAddress(host, port));
    } catch (IOException e) {
      result.close();
      throw e;
    }

  private var http2Connection: Http2Connection? = null

  internal val lock: ReentrantLock = ReentrantLock()

  // These properties are guarded by [lock].

  /**
   * If true, no new exchanges can be created on this connection. It is necessary to set this to
   * true when removing a connection from the pool; otherwise a racing caller might get it from the

    upstream = null
  }

  fun metadata(): ByteString = metadata

  /**
   * Returns a new source that returns the same bytes as upstream. Returns null if this relay has
   * been closed and no further sources are possible. In that case callers should retry after
   * building a new relay with [.read].
   */
  fun newSource(): Source? {
    synchronized(this@Relay) {
      if (file == null) return null

public class IssueReproductionTest {
  @Test public void getFailsWithoutAdditionalCert() throws IOException {
    OkHttpClient client = new OkHttpClient();

    sendRequest(client, "https://google.com/robots.txt");
  }

  private void sendRequest(OkHttpClient client, String url) throws IOException {
    Request request = new Request.Builder()
            .url(url)
            .build();
    try (Response response = client.newCall(request).execute()) {

 * should give up.
 *
 * When reactive authentication is requested by an origin web server, the response code is 401
 * and the implementation should respond with a new request that sets the "Authorization" header.
 *
 * ```java
 * if (response.request().header("Authorization") != null) {
 *   return null; // Give up, we've already failed to authenticate.
 * }
 *

   * the event source has already been closed or canceled.
   */
  fun cancel()

  fun interface Factory {
    /**
     * Creates a new event source and immediately returns it. Creating an event source initiates an
     * asynchronous process to connect the socket. Once that succeeds or fails, `listener` will be