}

  /**
   * Verify that we don't retry connections on certificate verification errors.
   *
   * http://code.google.com/p/android/issues/detail?id=13178
   */
  @Flaky
  @Test
  fun connectViaHttpsToUntrustedServer() {
    // Flaky https://github.com/square/okhttp/issues/5222
    server.useHttps(handshakeCertificates.sslSocketFactory())
    server.enqueue(MockResponse()) // unused
    assertFailsWith<IOException> {

      }
    }

  /** Returns true if the certificate was signed by [issuer]. */
  @Throws(SignatureException::class)
  fun checkSignature(issuer: PublicKey): Boolean {
    val signedData = CertificateAdapters.tbsCertificate.toDer(tbsCertificate)

    return Signature.getInstance(tbsCertificate.signatureAlgorithmName).run {
      initVerify(issuer)
      update(signedData.toByteArray())

@Target(AnnotationTarget.CLASS, AnnotationTarget.FUNCTION)
@Retention(AnnotationRetention.RUNTIME)
/**
 * Annotation marking a test as flaky, and requires extra logging and linking against
 * a known github issue.  This does not ignore the failure.
 */

   * https://github.com/square/okhttp/issues/5667
   */
  @Test
  fun hostToUriStripsCharacters() {
    val httpUrl = "http://example\".com/".toHttpUrl()
    assertThat(httpUrl.toUri().toString()).isEqualTo("http://example.com/")
  }

  /** Confirm that URI retains other characters. https://github.com/square/okhttp/issues/5236 */
  @Test
  fun hostToUriStripsCharacters2() {

      assertThat(response.body.string()).isEqualTo("abc")
      assertThat(response.trailers()).isEqualTo(headersOf("caboose", "xyz"))
    }
  }

  @Disabled("Follow up with fix in https://github.com/square/okhttp/issues/6853")
  @Test
  fun serverDisconnectsBeforeSecondRequestHttp1() {
    enableProtocol(Protocol.HTTP_1_1)

    server.enqueue(MockResponse(code = 200, body = "Req1"))

    If you want this update with the old behavior use [this interceptor][legacy_interceptor].

 *  Fix: Don't crash decompressing web sockets messages. We had a bug where we assumed deflated
    bytes in would always yield deflated bytes out and this isn't always the case!

 *  Fix: Reliably update and invalidate the disk cache on windows. As originally designed our

import assertk.assertions.isNull
import okhttp3.internal.http.parseChallenges
import org.junit.jupiter.api.Disabled
import org.junit.jupiter.api.Test

class HeadersChallengesTest {
  /** See https://github.com/square/okhttp/issues/2780.  */
  @Test fun testDigestChallengeWithStrictRfc2617Header() {
    val headers =
      Headers.Builder()
        .add(
          "WWW-Authenticate",

    assertInvalid("http://[::1%2544]", "Invalid URL host: \"[::1%2544]\"")
  }

  @Test
  fun hostIpv6AddressTooManyLeadingZeros() {
    // Guava's been buggy on this case. https://github.com/google/guava/issues/3116
    assertInvalid(
      "http://[2001:db8:0:0:1:0:0:00001]",
      "Invalid URL host: \"[2001:db8:0:0:1:0:0:00001]\"",
    )
  }

  @Test
  fun hostIpv6WithIpv4Suffix() {

[OpenJDK]: https://openjdk.java.net/groups/security/
[OpenJSSE]: https://github.com/openjsse/openjsse
[OpenSSL]: https://www.openssl.org/
[bug5592]: https://github.com/square/okhttp/issues/5592

    }
    this.subjectToCaCerts = map
  }

  override fun findByIssuerAndSignature(cert: X509Certificate): X509Certificate? {
    val issuer = cert.issuerX500Principal
    val subjectCaCerts = subjectToCaCerts[issuer] ?: return null

    return subjectCaCerts.firstOrNull {
      try {
        cert.verify(it.publicKey)
        return@firstOrNull true
      } catch (_: Exception) {