)
      },
    )

  /**
   * ```
   * BasicConstraints ::= SEQUENCE {
   *   cA                      BOOLEAN DEFAULT FALSE,
   *   pathLenConstraint       INTEGER (0..MAX) OPTIONAL
   * }
   * ```
   */
  private val basicConstraints: BasicDerAdapter<BasicConstraints> =
    Adapters.sequence(
      "BasicConstraints",
      Adapters.BOOLEAN.optional(defaultValue = false),

    }

  val subjectAlternativeNames: Extension?
    get() {
      return tbsCertificate.extensions.firstOrNull {
        it.id == ObjectIdentifiers.SUBJECT_ALTERNATIVE_NAME
      }
    }

  val basicConstraints: Extension
    get() {
      return tbsCertificate.extensions.first {
        it.id == ObjectIdentifiers.BASIC_CONSTRAINTS
      }
    }

  /** Returns true if the certificate was signed by [issuer]. */

    val okHttpCertificate =
      CertificateAdapters.certificate
        .fromDer(certificateByteString)

    assertThat(okHttpCertificate.basicConstraints).isEqualTo(
      Extension(
        id = BASIC_CONSTRAINTS,
        critical = true,
        value = BasicConstraints(true, 3),
      ),
    )
    assertThat(okHttpCertificate.commonName).isEqualTo("Jurassic Park")

    toVerify: X509Certificate,
    signingCert: X509Certificate,
    minIntermediates: Int,
  ): Boolean {
    if (toVerify.issuerDN != signingCert.subjectDN) {
      return false
    }
    if (signingCert.basicConstraints < minIntermediates) {
      return false // The signer can't have this many intermediates beneath it.
    }
    return try {
      toVerify.verify(signingCert.publicKey)
      true

import java.util.concurrent.TimeUnit
import okhttp3.internal.canParseAsIpAddress
import okhttp3.tls.internal.der.AlgorithmIdentifier
import okhttp3.tls.internal.der.AttributeTypeAndValue
import okhttp3.tls.internal.der.BasicConstraints
import okhttp3.tls.internal.der.BitString
import okhttp3.tls.internal.der.Certificate
import okhttp3.tls.internal.der.CertificateAdapters
import okhttp3.tls.internal.der.CertificateAdapters.generalNameDnsName

      .isEqualTo(bytes)
  }

  @Test fun `extension with type hint for basic constraints`() {
    val extension =
      Extension(
        BASIC_CONSTRAINTS,
        false,
        BasicConstraints(true, 4),
      )
    val bytes = "300f0603551d13040830060101ff020104".decodeHex()

    assertThat(CertificateAdapters.extension.toDer(extension))
      .isEqualTo(bytes)