// an SSL context for an attacking webserver. It includes both these rogue certificates plus the
    // trusted good certificate above. The attack is that by including the good certificate in the
    // chain, we may trick the certificate pinner into accepting the rouge certificate.
    val compromisedIntermediateCa =
      HeldCertificate.Builder()
        .signedBy(rootCa)
        .certificateAuthority(0)
        .serialNumber(4L)

// credit : 2014-03-20 Binky Moon, LLC
credit

// creditcard : 2014-03-20 Binky Moon, LLC
creditcard

// creditunion : 2015-01-22 DotCooperation LLC
creditunion

// cricket : 2014-10-09 dot Cricket Limited
cricket

// crown : 2014-10-24 Crown Equipment Corporation
crown

// crs : 2014-04-03 Federated Co-operatives Limited
crs

// cruise : 2015-12-10 Viking River Cruises (Bermuda) Ltd.

aquila.it ar ar.com ar.it ar.us arab arai.shizuoka.jp arakawa.saitama.jp arakawa.tokyo.jp aramco arao.kumamoto.jp arboretum.museum archaeological.museum archaeology.museum archi architectes.bj architecture.museum ardal.no aremark.no arendal.no arezzo.it ariake.saga.jp arida.wakayama.jp aridagawa.wakayama.jp arita.saga.jp arkhangelsk.su armenia.su army arna.no arpa arq.br art art.br art.do art.dz art.ht art.museum art.pl art.sn artanddesign.museum artcenter.museum artdeco.museum arte arte.bo arteducation.museum...

1F3C6..1F3CA  ; valid                  ;      ; NV8    # 6.0  TROPHY..SWIMMER
1F3CB..1F3CE  ; valid                  ;      ; NV8    # 7.0  WEIGHT LIFTER..RACING CAR
1F3CF..1F3D3  ; valid                  ;      ; NV8    # 8.0  CRICKET BAT AND BALL..TABLE TENNIS PADDLE AND BALL
1F3D4..1F3DF  ; valid                  ;      ; NV8    # 7.0  SNOW CAPPED MOUNTAIN..STADIUM
1F3E0..1F3F0  ; valid                  ;      ; NV8    # 6.0  HOUSE BUILDING..EUROPEAN CASTLE

import okhttp3.tls.internal.TlsUtil.localhost

/**
 * OkHttp is usually tested with functional tests: these use public APIs to confirm behavior against
 * MockWebServer. In cases where logic is particularly tricky, we use unit tests. This class makes
 * it easy to get sample values to use in such tests.
 *
 * This class is pretty fast and loose with default values: it attempts to provide values that are

Debug Logging
=============

OkHttp has internal APIs to enable debug logging. It uses the `java.util.logging` API which can be
tricky to configure. As a shortcut, you can paste [OkHttpDebugLogging.kt]. Then enable debug logging
for whichever features you need:

```
OkHttpDebugLogging.enableHttp2()
OkHttpDebugLogging.enableTaskRunner()
```

### Activating on Android

```
$ adb shell setprop log.tag.okhttp.Http2 DEBUG

# Calls

The HTTP client’s job is to accept your request and produce its response. This is simple in theory but it gets tricky in practice.

## [Requests](https://square.github.io/okhttp/4.x/okhttp/okhttp3/-request/)

Each HTTP request contains a URL, a method (like `GET` or `POST`), and a list of headers. Requests may also contain a body: a data stream of a specific content type.

## [Responses](https://square.github.io/okhttp/4.x/okhttp/okhttp3/-response/)

## Version 3.12.10

_2020-02-29_

 *  Fix: Don't crash on Android 4.1 when detecting methods that became restricted in Android 11.
    Supporting a full decade of Android releases on our 3.12.x branch is tricky!


## Version 3.12.9

_2020-02-24_

 *  Fix: Don't crash on Android 11 due to use of restricted methods. This prevents a crash with the
    exception, "Expected Android API level 21+ but was 29".

Symmetrically, interceptors can rewrite response headers and transform the response body. This is generally more dangerous than rewriting request headers because it may violate the webserver's expectations!

If you're in a tricky situation and prepared to deal with the consequences, rewriting response headers is a powerful way to work around problems. For example, you can fix a server's misconfigured `Cache-Control` response header to enable better response caching:

    ```java
        RequestBody.create(null, new byte[0]);
    ```

 * **`CertificatePinner` now supports wildcard hostnames.** As always with
   certificate pinning, you must be very careful to avoid [bricking][brick]
   your app. You'll need to pin both the top-level domain and the `*.` domain
   for full coverage.

    ```java
     client.setCertificatePinner(new CertificatePinner.Builder()