checkPublicSuffix("www.test.k12.ak.us", "test.k12.ak.us")
    // IDN labels.
    checkPublicSuffix("食狮.com.cn", "食狮.com.cn")
    checkPublicSuffix("食狮.公司.cn", "食狮.公司.cn")
    checkPublicSuffix("www.食狮.公司.cn", "食狮.公司.cn")
    checkPublicSuffix("shishi.公司.cn", "shishi.公司.cn")
    checkPublicSuffix("公司.cn", null)
    checkPublicSuffix("食狮.中国", "食狮.中国")
    checkPublicSuffix("www.食狮.中国", "食狮.中国")

   * are parsed. Android fails to parse these, which means we fall back to the CN. The RI does parse
   * them, so the CN is unused.
   */
  @Test fun verifyNonAsciiSubjectAlt() {
    // Expecting actual:
    //  ["bar.com", "花子.co.jp"]
    // to contain exactly (and in same order):
    //  ["bar.com", "������.co.jp"]
    platform.assumeNotBouncyCastle()

    // CN=foo.com, subjectAlt=bar.com, subjectAlt=花子.co.jp

    val response = call.execute()
    assertThat(response.handshake!!.peerPrincipal)
      .isEqualTo(X500Principal("CN=Local Host"))
    assertThat(response.handshake!!.localPrincipal)
      .isEqualTo(X500Principal("CN=Jethro Willis"))
    assertThat(response.body.string()).isEqualTo("abc")
  }

  @Test
  fun clientAuthForNeeds() {

```sh
mc idp ldap policy attach myminio mypolicy --user='uid=james,cn=accounts,dc=myldapserver,dc=com'
```

```sh
mc idp ldap policy attach myminio mypolicy ----group='cn=projectx,ou=groups,ou=hwengg,dc=min,dc=io'
```

To remove a policy association, use the similar `detach` command:

```sh
mc idp ldap policy detach myminio mypolicy --user='uid=james,cn=accounts,dc=myldapserver,dc=com'
```

```sh

  }

  @Test
  fun organizationalUnit() {
    val heldCertificate =
      HeldCertificate.Builder()
        .commonName("cash.app")
        .organizationalUnit("cash")
        .build()
    val certificate = heldCertificate.certificate
    assertThat(certificate.getSubjectX500Principal().name).isEqualTo(
      "CN=cash.app,OU=cash",
    )
  }

 * Peer certificate chain:
 *     sha256/afwiKY3RxoMmLkuRW1l7QsPZTJPwDS2pdDROQjXw8ig=: CN=publicobject.com, OU=PositiveSSL
 *     sha256/klO23nT2ehFDXCfx3eHTDRESMz3asj1muO+4aIdjiuY=: CN=COMODO RSA Secure Server CA
 *     sha256/grX4Ta9HpZx6tSHkmCrvpApTQGo67CYDnvprLg5yRME=: CN=COMODO RSA Certification Authority
 *     sha256/lCppFqbkrlJ3EcVFAkeip0+44VaoJUymbnOaEUk7tEU=: CN=AddTrust External CA Root
 * Pinned certificates for publicobject.com:

{!../../../docs_src/dependencies/tutorial010.py!}
```

!!! tip
    另一种创建上下文管理器的方法是：

    * <a href="https://docs.python.org/zh-cn/3/library/contextlib.html#contextlib.contextmanager" class="external-link" target="_blank">`@contextlib.contextmanager`</a>或者
    * <a href="https://docs.python.org/zh-cn/3/library/contextlib.html#contextlib.asynccontextmanager" class="external-link" target="_blank">`@contextlib.asynccontextmanager`</a>

      }

    /**
     * Set this certificate's common name (CN). Historically this held the hostname of TLS
     * certificate, but that practice was deprecated by [RFC 2818][rfc_2818] and replaced with
     * [addSubjectAlternativeName]. If unset a random string will be used.
     *
     * [rfc_2818]: https://tools.ietf.org/html/rfc2818
     */
    fun commonName(cn: String) =
      apply {
        this.commonName = cn
      }

      .assertLogMatch(Regex("""secureConnectStart"""))
      .assertLogMatch(
        Regex(
          """secureConnectEnd: Handshake\{tlsVersion=TLS_1_[23] cipherSuite=TLS_.* peerCertificates=\[CN=localhost] localCertificates=\[]\}""",
        ),
      )
      .assertLogMatch(Regex("""connectEnd: h2"""))
      .assertLogMatch(

      assertEquals(Protocol.HTTP_2, response.protocol)
      val tlsVersion = response.handshake?.tlsVersion
      assertTrue(tlsVersion == TlsVersion.TLS_1_2 || tlsVersion == TlsVersion.TLS_1_3)
      assertEquals(
        "CN=localhost",
        (response.handshake!!.peerCertificates.first() as X509Certificate).subjectDN.name,
      )
    }
  }

  @Test
  fun testCertificatePinningFailure() {
    enableTls()