val isSupported: Boolean =
      when {
        !isAndroid -> false
        Build.VERSION.SDK_INT >= 30 -> false // graylisted methods are banned
        else -> {
          // Fail Fast
          check(
            Build.VERSION.SDK_INT >= 21,
          ) { "Expected Android API level 21+ but was ${Build.VERSION.SDK_INT}" }

          true
        }
      }

  override fun getStackTraceForCloseable(closer: String): Any? {
    return if (Build.VERSION.SDK_INT >= 30) {
      CloseGuard().apply { open(closer) }
    } else {
      super.getStackTraceForCloseable(closer)
    }
  }

  override fun logCloseableLeak(
    message: String,
    stackTrace: Any?,
  ) {
    if (Build.VERSION.SDK_INT >= 30) {
      (stackTrace as CloseGuard).warnIfOpen()
    } else {

      .build()

  @Test
  fun getWithCustomSocketFactory() {
    assumeTrue(Build.VERSION.SDK_INT >= 24)

    class CustomSSLSocketFactory(
      delegate: SSLSocketFactory,
    ) : DelegatingSSLSocketFactory(delegate) {
      override fun configureSocket(sslSocket: SSLSocket): SSLSocket {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
          val parameters = sslSocket.sslParameters

        when {
          Build.VERSION.SDK_INT >= 24 -> {
            // Conscrypt 2.5+ defaults to SSLEngine-based SSLSocket
            assertEquals("org.conscrypt.Java8EngineSocket", socketClass)
          }
          Build.VERSION.SDK_INT < 22 -> {
            assertEquals("org.conscrypt.KitKatPlatformOpenSSLSocketImplAdapter", socketClass)
          }

@RunWith(AndroidJUnit4.class)
public class LetsEncryptTest {
  @Test public void getFailsWithoutAdditionalCert() throws IOException {
    OkHttpClient client = new OkHttpClient();

    boolean androidMorEarlier = Build.VERSION.SDK_INT <= 23;
    try {
      sendRequest(client, "https://valid-isrgrootx1.letsencrypt.org/robots.txt");
      if (androidMorEarlier) {
        fail();
      }
    } catch (SSLHandshakeException sslhe) {

class AlpnOverrideTest {
  class CustomSSLSocketFactory(
    delegate: SSLSocketFactory,
  ) : DelegatingSSLSocketFactory(delegate) {
    override fun configureSocket(sslSocket: SSLSocket): SSLSocket {
      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
        val parameters = sslSocket.sslParameters
        Log.d("CustomSSLSocketFactory", "old applicationProtocols: $parameters.applicationProtocols")

    }
  }

  @SuppressSignatureCheck
  companion object {
    fun buildIfSupported(): SocketAdapter? = if (isSupported()) Android10SocketAdapter() else null

    fun isSupported() = isAndroid && Build.VERSION.SDK_INT >= 29
  }

    // https://github.com/mannodermaus/android-junit5
    // Raised https://github.com/mannodermaus/android-junit5/issues/228 to reevaluate
    val androidMorEarlier = Build.VERSION.SDK_INT <= 23

    val clientBuilder = OkHttpClient.Builder()

    if (androidMorEarlier) {
      val cert: X509Certificate =
        """
        -----BEGIN CERTIFICATE-----

      try {
        // Enable session tickets.
        setUseSessionTickets.invoke(sslSocket, true)

        // Assume platform support on 24+
        if (hostname != null && Build.VERSION.SDK_INT <= 23) {
          // This is SSLParameters.setServerNames() in API 24+.
          setHostname.invoke(sslSocket, hostname)
        }

        // Enable ALPN.
        setAlpnProtocols.invoke(
          sslSocket,

      .heldCertificate(heldCertificate)
      .addTrustedCertificate(heldCertificate.certificate)
      .build()
  }

  @Before
  fun init() {
    assumeTrue("Supported on API 29+", Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)

    client =
      OkHttpClient.Builder()
        .dns(AsyncDns.toDns(AndroidAsyncDns.IPv4, AndroidAsyncDns.IPv6))
        .sslSocketFactory(localhost.sslSocketFactory(), localhost.trustManager)