val normalized = normalizeNfc(bufferB.readUtf8())
  bufferA.writeUtf8(normalized)

  // 3. For each label, convert/validate Punycode.
  val decoded = Punycode.decode(bufferA.readUtf8()) ?: return null

  // 4.1 Validate.

  // Must be NFC.
  if (decoded != normalizeNfc(decoded)) return null

  // TODO: Must not begin with a combining mark.
  // TODO: Each character must be 'valid' or 'deviation'. Not mapped.

    return result.readUtf8()
  }

  /**
   * Converts a single label from Punycode to Unicode.
   *
   * @return true if the range of [string] from [pos] to [limit] was valid and decoded successfully.
   *     Otherwise, the decode failed.
   */
  private fun decodeLabel(
    string: String,
    pos: Int,
    limit: Int,
    result: Buffer,
  ): Boolean {

    the proxy selectors are different. Ugh!


## Version 4.2.0

_2019-09-10_

 *  New: API to decode a certificate and private key to create a `HeldCertificate`. This accepts a
    string containing both a certificate and PKCS #8-encoded private key.

    ```kotlin
    val heldCertificate = HeldCertificate.decode("""
        |-----BEGIN CERTIFICATE-----
        |MIIBYTCCAQegAwIBAgIBKjAKBggqhkjOPQQDAjApMRQwEgYDVQQLEwtlbmdpbmVl

    assertNull(Punycode.decode("xn--a-9b.net"))
    assertEquals("a՚.net", Punycode.decode("xn--a-99b.net"))
    assertEquals("a溠.net", Punycode.decode("xn--a-999b.net"))
    assertEquals("a\uD8E2\uDF5C.net", Punycode.decode("xn--a-9999b.net"))
    assertNull(Punycode.decode("xn--a-99999b.net"))
  }

  @Test fun dashInPrefix() {
    testEncodeDecode(
      unicode = "klmnöpqrst-uvwxy",

  }

  @Test fun `cannot decode malformed utc time`() {
    val bytes = "170d3139313231362333303231305a".decodeHex()
    assertFailsWith<ProtocolException> {
      Adapters.UTC_TIME.fromDer(bytes)
    }.also { expected ->
      assertThat(expected).hasMessage("Failed to parse UTCTime 191216#30210Z")
    }
  }

  @Test fun `cannot decode generalized time with offset`() {

      |-----END PRIVATE KEY-----
      |
      """.trimMargin()
    try {
      decode(certificatePem)
      fail<Any>()
    } catch (expected: IllegalArgumentException) {
      assertThat(expected.message).isEqualTo("string does not include a private key")
    }
    try {
      decode(pkcs8Pem)
      fail<Any>()
    } catch (expected: IllegalArgumentException) {

/**
 * Tests for round-tripping headers through hpack.
 *
 * TODO: update hpack-test-case with the output of our encoder.
 * This test will hide complementary bugs in the encoder and decoder,
 * We should test that the encoder is producing responses that are
 */
class HpackRoundTripTest : HpackDecodeTestBase() {
  internal class StoriesTestProvider : SimpleProvider() {

 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package okhttp3.tls.internal.der

import okio.Buffer
import okio.ByteString

/**
 * Encode and decode a model object like a [Long] or [Certificate] as DER bytes.
 */
internal interface DerAdapter<T> {
  /** Returns true if this adapter can read [header] in a choice. */
  fun matches(header: DerHeader): Boolean

  /**

    } catch (e: NoSuchElementException) {
      throw IllegalArgumentException("failed to decode certificate", e)
    } catch (e: IllegalArgumentException) {
      throw IllegalArgumentException("failed to decode certificate", e)
    } catch (e: GeneralSecurityException) {
      throw IllegalArgumentException("failed to decode certificate", e)
    }
  }
}

internal data class TbsCertificate(

 * includes both natural exceptions such as unreachable servers, as well as synthetic exceptions
 * when responses are of an unexpected type or cannot be decoded.
 *
 * Other exception types cancel the current call:
 *
 *  * For synchronous calls made with [Call.execute], the exception is propagated to the caller.
 *