.serialNumber(1L)
        .certificateAuthority(2)
        .build()
    val certA =
      HeldCertificate
        .Builder()
        .serialNumber(2L)
        .certificateAuthority(1)
        .signedBy(root)
        .build()
    val certB =
      HeldCertificate
        .Builder()
        .serialNumber(3L)
        .certificateAuthority(0)
        .signedBy(certA)
        .build()

    val rootCa =
      HeldCertificate
        .Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .commonName("root")
        .build()
    val intermediateCa =
      HeldCertificate
        .Builder()
        .signedBy(rootCa)
        .certificateAuthority(0)
        .serialNumber(2L)
        .commonName("intermediate_ca")
        .build()
    val certificate =

    platform.assumeNotConscrypt()
    platform.assumeNotBouncyCastle()

    val clientRoot =
      HeldCertificate
        .Builder()
        .certificateAuthority(1)
        .build()
    val clientIntermediate =
      HeldCertificate
        .Builder()
        .certificateAuthority(0)
        .signedBy(clientRoot)
        .build()
    val clientCertificate =
      HeldCertificate
        .Builder()

We use `certificateAuthority(int)` to create certificates that can sign other certificates. The
int specifies how many intermediate certificates are allowed beneath it in the chain.

```java
HeldCertificate rootCertificate = new HeldCertificate.Builder()
    .certificateAuthority(1)
    .build();

HeldCertificate intermediateCertificate = new HeldCertificate.Builder()

import org.junit.jupiter.api.Test

class HandshakeTest {
  val serverRoot =
    HeldCertificate
      .Builder()
      .certificateAuthority(1)
      .build()
  val serverIntermediate =
    HeldCertificate
      .Builder()
      .certificateAuthority(0)
      .signedBy(serverRoot)
      .build()
  val serverCertificate =
    HeldCertificate
      .Builder()
      .signedBy(serverIntermediate)

      HeldCertificate
        .Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .commonName("root")
        .addSubjectAlternativeName("root_ca.com")
        .build()
    serverIntermediateCa =
      HeldCertificate
        .Builder()
        .signedBy(serverRootCa)
        .certificateAuthority(0)
        .serialNumber(2L)
        .commonName("intermediate_ca")

            unusedBitsCount = 0,
          ),
      ),
    )
  }

  @Test
  fun `certificate attributes`() {
    val certificate =
      HeldCertificate
        .Builder()
        .certificateAuthority(3)
        .commonName("Jurassic Park")
        .organizationalUnit("Gene Research")
        .addSubjectAlternativeName("*.example.com")
        .addSubjectAlternativeName("www.example.org")

  @BeforeEach
  fun setUp() {
    platform.assumeHttp2Support()
    platform.assumeNotBouncyCastle()
    rootCa =
      HeldCertificate
        .Builder()
        .serialNumber(1L)
        .certificateAuthority(0)
        .commonName("root")
        .build()
    certificate =
      HeldCertificate
        .Builder()
        .signedBy(rootCa)
        .serialNumber(2L)
        .commonName(server.hostName)

     * certificates). Set this to 1 so this certificate can sign intermediate certificates that can
     * themselves sign certificates. Add one for each additional layer of intermediates to permit.
     */
    fun certificateAuthority(maxIntermediateCas: Int) =
      apply {
        require(maxIntermediateCas >= 0) {
          "maxIntermediateCas < 0: $maxIntermediateCas"
        }
        this.maxIntermediateCas = maxIntermediateCas

    builder = builder.keyPair(keyPair)
    builder = builder.keyPair(keyPair.public, keyPair.private)
    builder = builder.signedBy(HeldCertificate.Builder().build())
    builder = builder.certificateAuthority(0)
    builder = builder.ecdsa256()
    builder = builder.rsa2048()
    val heldCertificate: HeldCertificate = builder.build()
  }

  @Test
  fun javaNetAuthenticator() {