final int _domainss = _src.dec_ndr_long();
                final int _domainsi = _src.index;
                _src.advance(12 * _domainss);

                if (this.domains == null) {
                    if (_domainss < 0 || _domainss > 0xFFFF) {
                        throw new NdrException(NdrException.INVALID_CONFORMANCE);
                    }
                    this.domains = new LsarTrustInformation[_domainss];

                final int _domainss = _src.dec_ndr_long();
                final int _domainsi = _src.index;
                _src.advance(12 * _domainss);

                if (domains == null) {
                    if (_domainss < 0 || _domainss > 0xFFFF) {
                        throw new NdrException(NdrException.INVALID_CONFORMANCE);
                    }
                    domains = new LsarTrustInformation[_domainss];
                }

        when(mockDeferredNdrBuffer.dec_ndr_long()).thenReturn(2); // _domainss

        refDomainList.decode(mockNdrBuffer);

        assertEquals(2, refDomainList.count);
        assertEquals(5, refDomainList.max_count);
        assertNotNull(refDomainList.domains);
        assertEquals(2, refDomainList.domains.length);

        if (DISABLED || auth.domain == "?") {
            return null;
        }

        if (_domains != null && System.currentTimeMillis() > _domains.expiration) {
            _domains = null;
        }
        if (_domains != null) {
            return _domains.map;
        }
        try {
            final UniAddress addr = UniAddress.getByName(auth.domain, true);

                || tf.getCredentials().getUserDomain().isEmpty()) {
            return null;
        }

        if (this._domains != null && System.currentTimeMillis() > this._domains.expiration) {
            this._domains = null;
        }
        if (this._domains != null) {
            return this._domains.map;
        }
        try {
            final String authDomain = tf.getCredentials().getUserDomain();

gc.ca

// cat : https://www.iana.org/domains/root/db/cat.html
cat

// cc : https://www.iana.org/domains/root/db/cc.html
cc

// cd : https://www.iana.org/domains/root/db/cd.html
// see also: https://www.nic.cd/domain/insertDomain_2.jsp?act=1
cd
gov.cd

// cf : https://www.iana.org/domains/root/db/cf.html
cf

// cg : https://www.iana.org/domains/root/db/cg.html
cg

            }
            rpc.domains = new lsarpc.LsarRefDomainList();
            rpc.domains.count = 1;
            rpc.domains.max_count = 1;
            rpc.domains.domains = new lsarpc.LsarTrustInformation[1];
            rpc.domains.domains[0] = new lsarpc.LsarTrustInformation();
            rpc.domains.domains[0].name = new UnicodeString("", false);
            rpc.domains.domains[0].sid = new jcifs.dcerpc.rpc.sid_t();

        cacheEntry.map = trustedDomains;
        dfs._domains = cacheEntry;

        assertEquals(trustedDomains, dfs.getTrustedDomains(auth));
    }

    @Test
    void testGetTrustedDomains_ExpiredCache() throws IOException, SmbAuthException {
        // Set up an expired cache entry
        Dfs.CacheEntry expiredEntry = new Dfs.CacheEntry(-1); // Expired
        testDfs._domains = expiredEntry;

				},
			},
			domains:          []string{"mys3.bucket.org"},
			bucket:           "mybucket",
			object:           "test/1.txt",
			expectedLocation: "https://mybucket.mys3.bucket.org/test/1.txt",
		},
	}
	for _, testCase := range testCases {
		t.Run("", func(t *testing.T) {
			gotLocation := getObjectLocation(testCase.request, testCase.domains, testCase.bucket, testCase.object)

* The encryption of the connection happens at the **TCP level**.
    * That's one layer **below HTTP**.
    * So, the **certificate and encryption** handling is done **before HTTP**.
* **TCP doesn't know about "domains"**. Only about IP addresses.
    * The information about the **specific domain** requested goes in the **HTTP data**.