check(connectState == ConnectState.READY)
      events += "plan $id TCP connecting..."

      taskFaker.sleep(tcpConnectDelayNanos)

      if (yieldBeforeTcpConnectReturns) {
        taskFaker.yield()
      }

      return when {
        tcpConnectThrowable != null -> {
          events += "plan $id TCP connect failed"

Após isso, o cliente e o servidor possuem uma conexão TCP encriptada, que é provida pelo TLS. E então eles podem usar essa conexão para começar a comunicação HTTP propriamente dita.

E isso resume o que é HTTPS, apenas HTTP simples dentro de uma conexão TLS segura em vez de uma conexão TCP pura (não encriptada).

/// tip | Dica

* Шифрование соединения происходит на **уровне TCP**.
    * Это на один уровень **ниже HTTP**.
    * Поэтому **сертификаты и шифрование** обрабатываются **до HTTP**.
* **TCP не знает о «доменах»**. Только об IP-адресах.
    * Информация о **конкретном домене** передаётся в **данных HTTP**.

import okhttp3.internal.platform.Platform
import okhttp3.internal.tls.OkHostnameVerifier
import okhttp3.internal.toHostHeader

/**
 * A single attempt to connect to a remote server, including these steps:
 *
 *  * [TCP handshake][connectSocket]
 *  * Optional [CONNECT tunnels][connectTunnel]. When using an HTTP proxy to reach an HTTPS server
 *    we must send a `CONNECT` request, and handle authorization challenges from the proxy.

Después de esto, el cliente y el servidor tienen una **conexión TCP encriptada**, esto es lo que proporciona TLS. Y luego pueden usar esa conexión para iniciar la comunicación **HTTP real**.

Y eso es lo que es **HTTPS**, es simplemente HTTP simple **dentro de una conexión TLS segura** en lugar de una conexión TCP pura (sin encriptar).

/// tip | Consejo

     * otherwise values must be between 1 and [Integer.MAX_VALUE] when converted to milliseconds.
     *
     * The connect timeout is applied when connecting a TCP socket to the target host. The default
     * value is 10 seconds.
     */
    fun connectTimeout(
      timeout: Long,
      unit: TimeUnit,
    ) = apply {

     *   <li>OPTIONS - Returns the HTTP methods that the server supports.</li>
     *   <li>TRACE - Echoes back the received request, used for debugging.</li>
     *   <li>CONNECT - Converts the request connection to a transparent TCP/IP tunnel.</li>
     * </ul>
     */
    public enum Method {
        /**
         * HTTP GET method.
         */
        GET,
        /**
         * HTTP POST method.
         */

   * this address.
   *
   * If [planToReplace] is non-null, this will swap it for a pooled connection if that pooled
   * connection uses HTTP/2. That results in fewer sockets overall and thus fewer TCP slow starts.
   */
  internal fun planReusePooledConnection(
    planToReplace: ConnectPlan? = null,
    routes: List<Route>? = null,
  ): ReusePlan? {
    val result =

 * by holding a lock on the connection.
 */
class RealConnection internal constructor(
  val taskRunner: TaskRunner,
  val connectionPool: RealConnectionPool,
  override val route: Route,
  /** The low-level TCP socket. */
  private val rawSocket: JavaNetSocket,
  /**
   * The application layer socket. Either an [SSLSocket] layered over [rawSocket], or [rawSocket]
   * itself if this connection does not use SSL.
   */

    compressed file (like a JAR or APK), so compressing its internal data was redundant.

 *  Fix: Call `ProxySelector.connectFailed()` when a connection's initial TCP handshake fails.

 *  Fix: Change the signature of `Dispatcher` to accept a nullable `ExecutorService`. Changing this
    parameter to be non-null was an unintended signature change in OkHttp 4.0.