ConnectionSpec.MODERN_TLS,
          ),
        )
        .sslSocketFactory(
          suppressTlsFallbackClientSocketFactory(),
          handshakeCertificates.trustManager,
        )
        .build()
    executeSynchronously("/").assertBody("abc")
  }

  @Test
  fun recoverFromTlsHandshakeFailure_tlsFallbackScsvEnabled() {
    platform.assumeNotConscrypt()

    val handshakeCertificates =
      HandshakeCertificates.Builder()
        .addPlatformTrustedCertificates()
        .build()
    val acceptedIssuers = handshakeCertificates.trustManager.acceptedIssuers
    val names =
      acceptedIssuers
        .map { it.subjectDN.name }
        .toSet()

    // It's safe to assume all platforms will have a major Internet certificate issuer.

  }

  private fun enableTls() {
    client =
      client.newBuilder()
        .sslSocketFactory(
          handshakeCertificates.sslSocketFactory(),
          handshakeCertificates.trustManager,
        )
        .hostnameVerifier(RecordingHostnameVerifier())
        .build()
    server1.useHttps(handshakeCertificates.sslSocketFactory())
    server2.useHttps(handshakeCertificates.sslSocketFactory())
  }

_2020-05-17_

 *  New: `HandshakeCertificates.Builder.addInsecureHost()` makes it easy to turn off security in
    private development environments that only carry test data. Prefer this over creating an
    all-trusting `TrustManager` because only hosts on the allowlist are insecure. From
    [our DevServer sample][dev_server]:

    ```kotlin
    val clientCertificates = HandshakeCertificates.Builder()
        .addPlatformTrustedCertificates()

        .body("ABC")
        .build(),
    )
    client =
      client.newBuilder()
        .sslSocketFactory(
          handshakeCertificates.sslSocketFactory(),
          handshakeCertificates.trustManager,
        )
        .hostnameVerifier(NULL_HOSTNAME_VERIFIER)
        .build()
    val request = Request.Builder().url(server.url("/")).build()
    val response1 = client.newCall(request).execute()

        clientTestRule.newClientBuilder()
          .protocols(listOf(Protocol.HTTP_2, Protocol.HTTP_1_1))
          .sslSocketFactory(
            handshakeCertificates.sslSocketFactory(),
            handshakeCertificates.trustManager,
          )
          .hostnameVerifier(RecordingHostnameVerifier())
          .build()
      scheme = "https"
    } else {
      server.protocols = listOf(Protocol.H2_PRIOR_KNOWLEDGE)
      client =