server.useHttps(serverCertificates.sslSocketFactory())
    server.enqueue(MockResponse())

    val clientCertificates =
      HandshakeCertificates
        .Builder()
        .addPlatformTrustedCertificates()
        .addInsecureHost(server.hostName)
        .build()

    val client =
      clientTestRule
        .newClientBuilder()

          .setHeader("Location", "https://www.google.com/robots.txt"),
      )
    }

  val clientCertificates =
    HandshakeCertificates
      .Builder()
      .addPlatformTrustedCertificates()
      .addInsecureHost(server.hostName)
      .build()

  val client =
    OkHttpClient
      .Builder()
      .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager)

This is the behavior you'll get with your OkHttpClient if you don't specifically configure
`HandshakeCertificates`. Or you can do it explicitly with `addPlatformTrustedCertificates()`:

```java
HandshakeCertificates clientCertificates = new HandshakeCertificates.Builder()
    .addPlatformTrustedCertificates()
    .build();
OkHttpClient client = new OkHttpClient.Builder()

        """.trimIndent().decodeCertificatePem()

      val handshakeCertificates =
        HandshakeCertificates
          .Builder()
          // TODO reenable in official answers
//      .addPlatformTrustedCertificates()
          .addTrustedCertificate(cert)
          .build()

      clientBuilder
        .sslSocketFactory(
          handshakeCertificates.sslSocketFactory(),
          handshakeCertificates.trustManager,

        .addTrustedCertificate(entrustRootCertificateAuthority)
        .addTrustedCertificate(comodoRsaCertificationAuthority)
        // Uncomment if standard certificates are also required.
        // .addPlatformTrustedCertificates()
        .build()
    client =
      OkHttpClient
        .Builder()
        .sslSocketFactory(certificates.sslSocketFactory(), certificates.trustManager)
        .build()
  }

  }

  @Test fun platformTrustedCertificates() {
    val handshakeCertificates =
      HandshakeCertificates
        .Builder()
        .addPlatformTrustedCertificates()
        .build()
    val acceptedIssuers = handshakeCertificates.trustManager.acceptedIssuers
    val names =
      acceptedIssuers
        .map { it.subjectDN.name }
        .toSet()

        throw TestAbortedException("Google Play Services not available", gpsnae)
      }

      val clientCertificates =
        HandshakeCertificates
          .Builder()
          .addPlatformTrustedCertificates()
          .addInsecureHost(server.hostName)
          .build()

      // Need fresh client to reset sslSocketFactoryOrNull
      client =
        OkHttpClient
          .Builder()

     * certificates. Applications that connect to a known set of servers may be able to mitigate
     * this problem with [certificate pinning][CertificatePinner].
     */
    fun addPlatformTrustedCertificates() =
      apply {
        val platformTrustManager = Platform.get().platformTrustManager()
        Collections.addAll(trustedCertificates, *platformTrustManager.acceptedIssuers)
      }

    /**

    builder = builder.heldCertificate(heldCertificate, heldCertificate.certificate)
    builder = builder.addTrustedCertificate(heldCertificate.certificate)
    builder = builder.addPlatformTrustedCertificates()
    val handshakeCertificates: HandshakeCertificates = builder.build()
  }

  @Test
  fun heldCertificate() {
    val heldCertificate: HeldCertificate = HeldCertificate.Builder().build()

    [our DevServer sample][dev_server]:

    ```kotlin
    val clientCertificates = HandshakeCertificates.Builder()
        .addPlatformTrustedCertificates()
        .addInsecureHost("localhost")
        .build()

    val client = OkHttpClient.Builder()
        .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager)