// with MD5 or 512-bit RSA; that's insecure!
    //
    // openssl req \
    //   -x509 \
    //   -md5 \
    //   -nodes \
    //   -days 1 \
    //   -newkey rsa:512 \
    //   -keyout privateKey.key \
    //   -out certificate.crt
    val certificatePem =
      """
      |-----BEGIN CERTIFICATE-----

    // [distinguished_name]
    // [req_extensions]
    // [x509_extensions]
    // subjectAltName=DNS:localhost.localdomain,DNS:localhost,IP:127.0.0.1
    //
    // $ openssl req -x509 -nodes -days 36500 -subj '/CN=localhost' -config ./cert.cnf \
    //     -newkey rsa:512 -out cert.pem
    val certificate =
      certificate(
        """
        -----BEGIN CERTIFICATE-----

    assertFailsWith<IOException> {
      getResponse(newRequest("/foo"))
    }.also { expected ->
      when (expected) {
        is SSLHandshakeException -> {
          // Allow conscrypt to fail in different ways
          if (!platform.isConscrypt()) {
            assertThat(expected.cause!!).isInstanceOf<CertificateException>()
          }
        }
        is TlsFatalAlert -> {}
        else -> throw expected
      }

        .maxAge(2, TimeUnit.DAYS)
        .build()
    assertThat(cacheControl.toString()).isEqualTo("max-age=172800")
    assertThat(cacheControl.toString()).isSameAs(cacheControl.toString())
  }

  @Test
  @Throws(Exception::class)
  fun timeDurationTruncatedToMaxValue() {
    val cacheControl =
      CacheControl.Builder()
        .maxAge(365 * 100, TimeUnit.DAYS) // Longer than Integer.MAX_VALUE seconds.

    //      last modified: 105 days ago
    //             served:   5 days ago
    //   default lifetime: (105 - 5) / 10 = 10 days
    //            expires:  10 days from served date = 5 days from now
    server.enqueue(
      MockResponse.Builder()
        .addHeader("Last-Modified: " + formatDate(-105, TimeUnit.DAYS))
        .addHeader("Date: " + formatDate(-5, TimeUnit.DAYS))
        .body("A")
        .build(),

        return buildRedirectRequest(userResponse, method)
      }

      HTTP_CLIENT_TIMEOUT -> {
        // 408's are rare in practice, but some servers like HAProxy use this response code. The
        // spec says that we may repeat the request without modifications. Modern browsers also
        // repeat the request (even non-idempotent ones.)
        if (!client.retryOnConnectionFailure) {

Calls are executed in one of two ways:

 * **Synchronous:** your thread blocks until the response is readable.

 * [advanceUntil]. These functions don't return until the task threads are all idle.
 *
 * Task threads release their execution privilege in these ways:
 *
 *  * By yielding in [TaskRunner.Backend.coordinatorWait].
 *  * By yielding in [BlockingQueue.poll].
 *  * By completing.
 */
class TaskFaker : Closeable {
  @Suppress("NOTHING_TO_INLINE")

  private val algorithmParameters: DerAdapter<Any?> =
    Adapters.usingTypeHint { typeHint ->
      when (typeHint) {
        // This type is pretty strange. The spec says that for certain algorithms we must encode null
        // when it is present, and for others we must omit it!
        // https://tools.ietf.org/html/rfc4055#section-2.1

    hand it off to another thread to write to it after `writeTo` returns.

    The `EventListener` may now see requests and responses interleaved in ways not previously
    permitted. For example, a listener may receive `responseHeadersStart()` followed by
    `requestBodyEnd()`, both on the same call. Such events may be triggered by different threads
    even for a single call.