val certificate = heldCertificate.certificate
    assertThat(certificate.getSubjectX500Principal().name).isEqualTo(
      "CN=cash.app,OU=cash",
    )
  }

  /** Confirm golden values of encoded PEMs.  */
  @Test
  fun pems() {
    val keyFactory = KeyFactory.getInstance("RSA")
    val publicKeyBytes =
      (
        "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCApFHhtrLan28q+oMolZuaTfWBA0V5aM" +

import java.security.cert.X509Certificate
import okio.Buffer
import okio.ByteString
import okio.ByteString.Companion.toByteString

/**
 * Decodes a multiline string that contains a [certificate][certificatePem] which is
 * [PEM-encoded][rfc_7468]. A typical input string looks like this:
 *
 * ```
 * -----BEGIN CERTIFICATE-----
 * MIIBYTCCAQegAwIBAgIBKjAKBggqhkjOPQQDAjApMRQwEgYDVQQLEwtlbmdpbmVl

import okhttp3.tls.decodeCertificatePem

class CustomTrust {
  // PEM files for root certificates of Comodo and Entrust. These two CAs are sufficient to view
  // https://publicobject.com (Comodo) and https://squareup.com (Entrust). But they aren't
  // sufficient to connect to most HTTPS sites including https://godaddy.com and https://visa.com.
  // Typically developers will need to get a PEM file from their organization's TLS administrator.

  )
  fun keyPair(): KeyPair = keyPair

  /**
   * Returns the certificate encoded in [PEM format][rfc_7468].
   *
   * [rfc_7468]: https://tools.ietf.org/html/rfc7468
   */
  fun certificatePem(): String = certificate.certificatePem()

  /**
   * Returns the private key encoded in [PKCS #8][rfc_5208] [PEM format][rfc_7468].
   *
   * [rfc_5208]: https://tools.ietf.org/html/rfc5208

    // subjectAltName=DNS:localhost.localdomain,DNS:localhost,IP:127.0.0.1
    //
    // $ openssl req -x509 -nodes -days 36500 -subj '/CN=localhost' -config ./cert.cnf \
    //     -newkey rsa:512 -out cert.pem
    val certificate =
      certificate(
        """
        -----BEGIN CERTIFICATE-----
        MIIBWDCCAQKgAwIBAgIJANS1EtICX2AZMA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV

    .build();
OkHttpClient client = new OkHttpClient.Builder()
    .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager())
    .build();
```

PEM files
---------

You can encode a `HeldCertificate` in PEM format:

```java
HeldCertificate heldCertificate = ...
System.out.println(heldCertificate.certificatePem())
```

```
-----BEGIN CERTIFICATE-----

          java-version: 11

      - name: Configure JDK
        uses: actions/setup-java@v5
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Enable KVM group perms
        # https://github.blog/changelog/2023-02-23-hardware-accelerated-android-virtualization-on-actions-windows-and-linux-larger-hosted-runners/
        run: |

      We could probably have resumed it after https://github.com/google/guava/pull/6664.
      But it's always weird that published poms reference test-only libraries at all, so I'm not in any rush to do so.
      -->
    </dependencies>
  </dependencyManagement>
  <profiles>
    <profile>
      <id>sonatype-oss-release</id>
      <build>

      We could probably have resumed it after https://github.com/google/guava/pull/6664.
      But it's always weird that published poms reference test-only libraries at all, so I'm not in any rush to do so.
      -->
    </dependencies>
  </dependencyManagement>
  <profiles>
    <profile>
      <id>sonatype-oss-release</id>
      <build>

"mateixos", "me", "mentre", "més", "meu", "meus", "meva", "meves", "molt", "molta", "moltes", "molts", "mon", "mons", "n'he", "n'hi", "ne", "ni", "no", "nogensmenys", "només", "nosaltres", "nostra", "nostre", "nostres", "o", "oh", "oi", "on", "pas", "pel", "pels", "per", "però", "perquè", "poc ", "poca", "pocs", "poques", "potser", "propi", "qual", "quals", "quan", "quant ", "que", "què", "quelcom", "qui", "quin", "quina", "quines", "quins", "s'ha", "s'han", "sa", "semblant", "semblants", "ses", "seu ", "seus",...