.containsExactly(TlsVersion.TLS_1_2)
    assertThat(tlsSpec.supportsTlsExtensions).isTrue()
  }

  @Test
  fun tls_defaultCiphers_noFallbackIndicator() {
    platform.assumeNotConscrypt()
    platform.assumeNotBouncyCastle()
    val tlsSpec =
      ConnectionSpec.Builder(true)
        .tlsVersions(TlsVersion.TLS_1_2)
        .supportsTlsExtensions(false)
        .build()

  }

  @Test
  fun testDefaultHandshakeCipherSuiteOrderingTls12Restricted() {
    // We are avoiding making guarantees on ordering of secondary Platforms.
    platform.assumeNotConscrypt()
    platform.assumeNotBouncyCastle()

    val client = makeClient(ConnectionSpec.RESTRICTED_TLS, TlsVersion.TLS_1_2)

    val handshake = makeRequest(client)

  }

  @AfterEach fun tearDown() {
    executorService.shutdown()
    serverSocket?.closeQuietly()
  }

  @Test fun clientAndServer() {
    platform.assumeNotConscrypt()
    platform.assumeNotBouncyCastle()

    val clientRoot =
      HeldCertificate.Builder()
        .certificateAuthority(1)
        .build()
    val clientIntermediate =
      HeldCertificate.Builder()

  @BeforeEach
  fun setUp(server: MockWebServer) {
    this.server = server
  }

  @Test
  fun clientSendsServerNameAndServerReceivesIt() {
    // java.net.ConnectException: Connection refused
    platform.assumeNotConscrypt()

    val handshakeCertificates = localhost()
    server.useHttps(handshakeCertificates.sslSocketFactory())

    val dns =
      Dns {
        Dns.SYSTEM.lookup(server.hostName)
      }

    }

    fun assumeAndroid() {
      assumeTrue(Platform.isAndroid)
    }

    fun assumeGraalVMImage() {
      assumeTrue(isGraalVMImage())
    }

    fun assumeNotConscrypt() {
      assumeTrue(getPlatformSystemProperty() != CONSCRYPT_PROPERTY)
    }

    fun assumeNotJdk9() {
      assumeTrue(getPlatformSystemProperty() != JDK9_PROPERTY)
    }

    assertThat(verifier.verify("tel.com", session)).isFalse()
    assertThat(verifier.verify("k.com", session)).isFalse()
  }

  @Test fun specialKInExternalCert() {
    // OpenJDK related test.
    platform.assumeNotConscrypt()

    // Expecting actual:
    //  ["℡.com", "K.com"]
    // to contain exactly (and in same order):
    //  ["���.com", "���.com"]
    platform.assumeNotBouncyCastle()

    // $ cat ./cert.cnf

    assertThat(handshake.peerPrincipal).isNull()
    assertThat(handshake.peerCertificates.size).isEqualTo(0)
  }

  @Test
  fun httpsWithClientAuth() {
    platform.assumeNotBouncyCastle()
    platform.assumeNotConscrypt()
    val clientCa =
      HeldCertificate.Builder()
        .certificateAuthority(0)
        .build()
    val serverCa =
      HeldCertificate.Builder()
        .certificateAuthority(0)

    assertThat(handshake.peerPrincipal).isNull()
    assertThat(handshake.peerCertificates.size).isEqualTo(0)
  }

  @Test
  fun httpsWithClientAuth() {
    platform.assumeNotBouncyCastle()
    platform.assumeNotConscrypt()

    val clientCa =
      HeldCertificate.Builder()
        .certificateAuthority(0)
        .build()
    val serverCa =
      HeldCertificate.Builder()
        .certificateAuthority(0)

        )
        .build()
    executeSynchronously("/").assertBody("abc")
  }

  @Test
  fun recoverFromTlsHandshakeFailure_tlsFallbackScsvEnabled() {
    platform.assumeNotConscrypt()
    val tlsFallbackScsv = "TLS_FALLBACK_SCSV"
    val supportedCiphers = listOf(*handshakeCertificates.sslSocketFactory().supportedCipherSuites)
    if (!supportedCiphers.contains(tlsFallbackScsv)) {