server.useHttps(serverCertificates.sslSocketFactory())
    server.enqueue(MockResponse())

    val clientCertificates =
      HandshakeCertificates.Builder()
        .addPlatformTrustedCertificates()
        .addInsecureHost(server.hostName)
        .build()

    val client =
      clientTestRule.newClientBuilder()

          .setResponseCode(HTTP_MOVED_TEMP)
          .setHeader("Location", "https://www.google.com/robots.txt"),
      )
    }

  val clientCertificates =
    HandshakeCertificates.Builder()
      .addPlatformTrustedCertificates()
      .addInsecureHost(server.hostName)
      .build()

  val client =
    OkHttpClient.Builder()
      .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager)

}

public final class okhttp3/tls/HandshakeCertificates$Builder {
	public fun <init> ()V
	public final fun addInsecureHost (Ljava/lang/String;)Lokhttp3/tls/HandshakeCertificates$Builder;
	public final fun addPlatformTrustedCertificates ()Lokhttp3/tls/HandshakeCertificates$Builder;
	public final fun addTrustedCertificate (Ljava/security/cert/X509Certificate;)Lokhttp3/tls/HandshakeCertificates$Builder;

This is the behavior you'll get with your OkHttpClient if you don't specifically configure
`HandshakeCertificates`. Or you can do it explicitly with `addPlatformTrustedCertificates()`:

```java
HandshakeCertificates clientCertificates = new HandshakeCertificates.Builder()
    .addPlatformTrustedCertificates()
    .build();
OkHttpClient client = new OkHttpClient.Builder()

    assumeNetwork()

    val request = Request.Builder().url("https://api.twitter.com/robots.txt").build()

    val clientCertificates =
      HandshakeCertificates.Builder()
        .addPlatformTrustedCertificates()
        .apply {
          if (Build.VERSION.SDK_INT >= 24) {
            addInsecureHost(server.hostName)
          }
        }
        .build()

    client =
      client.newBuilder()

        """.trimIndent().decodeCertificatePem()

      val handshakeCertificates =
        HandshakeCertificates.Builder()
          // TODO reenable in official answers
//      .addPlatformTrustedCertificates()
          .addTrustedCertificate(cert)
          .build()

      clientBuilder
        .sslSocketFactory(
          handshakeCertificates.sslSocketFactory(),
          handshakeCertificates.trustManager,

    val heldCertificate =
      HeldCertificate.Builder()
        .addSubjectAlternativeName("localhost")
        .build()
    return@lazy HandshakeCertificates.Builder()
      .addPlatformTrustedCertificates()
      .heldCertificate(heldCertificate)
      .addTrustedCertificate(heldCertificate.certificate)
      .build()
  }

  @Before
  fun init() {

        .addTrustedCertificate(entrustRootCertificateAuthority)
        .addTrustedCertificate(comodoRsaCertificationAuthority)
        // Uncomment if standard certificates are also required.
        // .addPlatformTrustedCertificates()
        .build()
    client =
      OkHttpClient.Builder()
        .sslSocketFactory(certificates.sslSocketFactory(), certificates.trustManager)
        .build()
  }

  fun run() {

      .isEqualTo(listOf(certificate.certificate, intermediate.certificate))
  }

  @Test fun platformTrustedCertificates() {
    val handshakeCertificates =
      HandshakeCertificates.Builder()
        .addPlatformTrustedCertificates()
        .build()
    val acceptedIssuers = handshakeCertificates.trustManager.acceptedIssuers
    val names =
      acceptedIssuers
        .map { it.subjectDN.name }
        .toSet()

     * certificates. Applications that connect to a known set of servers may be able to mitigate
     * this problem with [certificate pinning][CertificatePinner].
     */
    fun addPlatformTrustedCertificates() =
      apply {
        val platformTrustManager = Platform.get().platformTrustManager()
        Collections.addAll(trustedCertificates, *platformTrustManager.acceptedIssuers)
      }

    /**