}
    }
  }

  /**
   * Not checking the CA bit created a vulnerability in old OkHttp releases. It is exploited by
   * triggering different chains to be discovered by the TLS engine and our chain cleaner. In this
   * attack there's several different chains.
   *
   *
   * The victim's gets a non-CA certificate signed by a CA, and pins the CA root and/or
   * intermediate. This is business as usual.
   *

        }
    }

    @Override
    public String toString() {
        final int len = this.length / 2 - (this.zterm ? 1 : 0);
        final char[] ca = new char[len];
        for (int i = 0; i < len; i++) {
            ca[i] = (char) this.buffer[i];
        }
        return new String(ca, 0, len);
    }

        }
    }

    @Override
    public String toString() {
        final int len = length / 2 - (zterm ? 1 : 0);
        final char[] ca = new char[len];
        for (int i = 0; i < len; i++) {
            ca[i] = (char) buffer[i];
        }
        return new String(ca, 0, len);
    }

    @app.get("/facilities/{facility_id}")
    def get_facility(facility_id: str) -> Facility:
        return Facility(
            id=facility_id,
            address=Address(line_1="123 Main St", city="Anytown", state_province="CA"),
        )

    client = TestClient(app)
    return client


def test_get(client: TestClient):
    response = client.get("/facilities/42")
    assert response.status_code == 200, response.text

For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`:

```
kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt
```

If TLS is not enabled, you would need only the third party CA:

```

* Inside the `certs` directory, the private key must by named `private.key` and the public key must be named `public.crt`.
* A certificate signed by a CA contains information about the issued identity (e.g. name, expiry, public key) and any intermediate certificates. The root CA is not included.

## 3. Generate and use Self-signed Keys and Certificates with MinIO

    }

    @Test
    public void test_user_state() {
        final User user = new User();
        assertNull(user.getState());

        user.setState("CA");
        assertEquals("CA", user.getState());
    }

    @Test
    public void test_user_street() {
        final User user = new User();
        assertNull(user.getStreet());

        user.setStreet("123 Main St");

# Other build-related tools
apt-transport-https
autoconf
automake
build-essential
ca-certificates
curl
git
parallel
sudo
swig
unzip
zip
openjdk-21-jdk
vim
wget
jq

- Kubernetes cluster with `kubectl` configured.

- Acquire TLS certificates, either from a CA or [create self-signed certificates](https://docs.min.io/community/minio-object-store/operations/network-encryption.html).

	errSFTPUserHasNoPolicies  = errors.New("no policies present on this account")
	errSFTPLDAPNotEnabled     = errors.New("ldap authentication is not enabled")
)

// if the sftp parameter --trusted-user-ca-key is set, then
// the final form of the key file will be set as this variable.
var globalSFTPTrustedCAPubkey ssh.PublicKey

// https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.22.0:ssh/common.go;l=46