You can build your own connection spec with a custom set of TLS versions and cipher suites. For example, this configuration is limited to three highly-regarded cipher suites. Its drawback is that it requires Android 5.0+ and a similarly current webserver.

```java
ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)

 * **REMOVED:** ~~TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA~~
 * **REMOVED:** ~~TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA~~


[OkHttp 3.5][OkHttp35]
----------------------

_2016-11-30_

Remove three old cipher suites and add five new ones. This tracks changes in what's available on
Android and Java, and also what cipher suites recent releases of Chrome and Firefox support by
default.

        .build(),
    )
    server.enqueue(
      MockResponse.Builder()
        .code(HttpURLConnection.HTTP_NOT_MODIFIED)
        .build(),
    )

    // At least three request/response pairs are required because after the first request is cached
    // a different execution path might be taken. Thus modifications to the cache applied during

1EB3          ; valid                                  # 1.1  LATIN SMALL LETTER A WITH BREVE AND HOOK ABOVE
1EB4          ; mapped                 ; 1EB5          # 1.1  LATIN CAPITAL LETTER A WITH BREVE AND TILDE
1EB5          ; valid                                  # 1.1  LATIN SMALL LETTER A WITH BREVE AND TILDE
1EB6          ; mapped                 ; 1EB7          # 1.1  LATIN CAPITAL LETTER A WITH BREVE AND DOT BELOW

netlify.app

// Neustar Inc.
// Submitted by Trung Tran <******@****.***>
4u.com

// ngrok : https://ngrok.com/
// Submitted by Alan Shreve <******@****.***>
ngrok.io

// Nimbus Hosting Ltd. : https://www.nimbushosting.co.uk/
// Submitted by Nicholas Ford <******@****.***>
nh-serv.co.uk

    }

    redQueue.execute("task three", 100.µs) {
      log += "three:run@${taskFaker.nanoTime} parallel=${taskFaker.isParallel}"
    }

    taskFaker.advanceUntil(0.µs)
    assertThat(log).isEmpty()

    taskFaker.advanceUntil(100.µs)
    assertThat(log).containsExactly(
      "one:run@100000 parallel=false",
      "two:run@100000 parallel=false",
      "three:run@100000 parallel=false",
    )

with Java.

We spent a lot of time and energy on retaining strict compatibility with OkHttp 3.x. We’re even
keeping the package name the same: `okhttp3`!

There are three kinds of compatibility we’re tracking:

 * **Binary compatibility** is the ability to compile a program against OkHttp 3.x, and then to run
   it against OkHttp 4.x. We’re using the excellent [japicmp][japicmp] library via its

   00A0; NO-BREAK SPACE
   1680; OGHAM SPACE MARK
   2000; EN QUAD
   2001; EM QUAD
   2002; EN SPACE
   2003; EM SPACE
   2004; THREE-PER-EM SPACE
   2005; FOUR-PER-EM SPACE
   2006; SIX-PER-EM SPACE
   2007; FIGURE SPACE
   2008; PUNCTUATION SPACE
   2009; THIN SPACE
   200A; HAIR SPACE
   200B; ZERO WIDTH SPACE
   202F; NARROW NO-BREAK SPACE
   205F; MEDIUM MATHEMATICAL SPACE

 * host platform (like Android). In July 2018 Android had 134 trusted root certificates for its HTTP
 * clients to trust.
 *
 * For example, in order to establish a secure connection to `https://www.squareup.com/`,
 * these three certificates are used.
 *
 * ```
 * www.squareup.com certificate:
 *
 * Common Name: www.squareup.com
 * Subject Alternative Names: www.squareup.com, squareup.com, account.squareup.com...

 * may cause corruption or runtime errors if not. It may however be shared amongst multiple OkHttpClient
 * instances.
 *
 * ## Cache Optimization
 *
 * To measure cache effectiveness, this class tracks three statistics:
 *
 *  * **[Request Count:][requestCount]** the number of HTTP requests issued since this cache was
 *    created.
 *  * **[Network Count:][networkCount]** the number of those requests that required network use.