if (Conscrypt.isConscrypt(sslSocket)) {
      Conscrypt.getApplicationProtocol(sslSocket)
    } else {
      super.getSelectedProtocol(sslSocket)
    }

  override fun newSslSocketFactory(trustManager: X509TrustManager): SSLSocketFactory =
    newSSLContext()
      .apply {
        init(null, arrayOf<TrustManager>(trustManager), null)
      }.socketFactory

  companion object {

    platform.assumeNotConscrypt()
    platform.assumeNotBouncyCastle()

    val platform = Platform.get()
    val platformDefaultCipherSuites =
      platform.newSslSocketFactory(platform.platformTrustManager()).defaultCipherSuites
    val cipherSuites =
      ConnectionSpec.RESTRICTED_TLS.effectiveCipherSuites(platformDefaultCipherSuites)

    BasicCertificateChainCleaner(buildTrustRootIndex(trustManager))

  open fun buildTrustRootIndex(trustManager: X509TrustManager): TrustRootIndex = BasicTrustRootIndex(*trustManager.acceptedIssuers)

  open fun newSslSocketFactory(trustManager: X509TrustManager): SSLSocketFactory {
    try {
      return newSSLContext()
        .apply {
          init(null, arrayOf<TrustManager>(trustManager), null)
        }.socketFactory

          .withCertificateChainCleaner(certificateChainCleaner)
    } else {
      this.x509TrustManager = Platform.get().platformTrustManager()
      this.sslSocketFactoryOrNull = Platform.get().newSslSocketFactory(x509TrustManager)
      this.certificateChainCleaner = CertificateChainCleaner.get(x509TrustManager)
      this.certificatePinner =
        builder.certificatePinner