if (!decodeIpv4Suffix(input, groupOffset, limit, address, b - 2)) return null
        b += 2 // We rewound two bytes and then added four.
        break
      } else {
        return null // Wrong delimiter.
      }
    }

    // Read a group, one to four hex digits.
    var value = 0
    groupOffset = i
    while (i < limit) {
      val hexDigit = input[i].parseHexDigit()

  }

  @Test
  fun connectViaHttpProxyToHttpsUsingHttpsProxySystemProperty() {
    testConnectViaHttpProxyToHttps(ProxyConfig.HTTPS_PROXY_SYSTEM_PROPERTY)
  }

  /**
   * We were verifying the wrong hostname when connecting to an HTTPS site through a proxy.
   * http://b/3097277
   */
  private fun testConnectViaHttpProxyToHttps(proxyConfig: ProxyConfig) {
    val hostnameVerifier = RecordingHostnameVerifier()

            byteString = okHttpCertificate.signatureValue.byteString.offByOneBit(),
          ),
      )
    assertThat(okHttpCertificateWithBadSignature.checkSignature(root.keyPair.public)).isFalse()

    // Wrong public key.
    assertThat(okHttpCertificate.checkSignature(certificate.keyPair.public)).isFalse()
  }

  @Test
  fun `EC issuer and signature`() {
    val root =
      HeldCertificate.Builder()

in OkHttp 3.x and are final in 4.x. These were made non-final for use with mocking frameworks like
[Mockito][mockito]. We believe subtyping `OkHttpClient` is the wrong way to test with OkHttp. If
you must, mock `Call.Factory` which is the interface that `OkHttpClient` implements.

#### Internal API changes

   *             -> pinnedIntermediate (trusted by CertificatePinner)
   *                 -> attackerSwitch (not a CA certificate!)
   *                     -> phonyVictim
   * ```
   *
   * But this chain is wrong because the attackerSwitch certificate is being used in a CA role even
   * though it is not a CA certificate. There are pinned certificates in the chain! The correct
   * chain is much shorter because it skips the non-CA certificate.

cloud.nospamproxy.com

// Netlify : https://www.netlify.com
// Submitted by Jessica Parsons <******@****.***>
netlify.app

// Neustar Inc.
// Submitted by Trung Tran <Trung******@****.***>
4u.com

// ngrok : https://ngrok.com/
// Submitted by Alan Shreve <******@****.***>
ngrok.io

// Nimbus Hosting Ltd. : https://www.nimbushosting.co.uk/

gr.eu.org gr.it gr.jp grainger grajewo.pl gran.no grandrapids.museum grane.no granvin.no graphics graphox.us gratangen.no gratis graz.museum greater.jp green greta.fr grimstad.no gripe griw.gov.pl grocery groks-the.info groks-this.info grondar.za grong.no grosseto.it groundhandling.aero group group.aero grozny.ru grozny.su grp.lk gru.br grue.no gs gs.aa.no gs.ah.no gs.bu.no gs.cn gs.fm.no gs.hl.no gs.hm.no gs.jan-mayen.no gs.mr.no gs.nl.no gs.nt.no gs.of.no gs.ol.no gs.oslo.no gs.rl.no gs.sf.no gs.st.no...

2FAD          ; mapped                 ; 9751          # 3.0  KANGXI RADICAL BLUE
2FAE          ; mapped                 ; 975E          # 3.0  KANGXI RADICAL WRONG
2FAF          ; mapped                 ; 9762          # 3.0  KANGXI RADICAL FACE
2FB0          ; mapped                 ; 9769          # 3.0  KANGXI RADICAL LEATHER

      private var canRemove = false

      override fun hasNext(): Boolean {
        if (nextUrl != null) return true

        canRemove = false // Prevent delegate.remove() on the wrong item!
        while (delegate.hasNext()) {
          try {
            delegate.next().use { snapshot ->
              val metadata = snapshot.getSource(ENTRY_METADATA).buffer()

          CertificatePinner.Builder()
            .add(server.hostName, "sha1/DmxUShsZuNiqPQsX2Oi9uv2sCnw=")
            .build(),
        )
        .build()

    // When we pin the wrong certificate, connectivity fails.
    val request = Request.Builder().url(server.url("/")).build()
    assertFailsWith<SSLPeerUnverifiedException> {
      client.newCall(request).execute()
    }.also { expected ->