<!-- TODO: Improve the wording. Mention the tlskyber GODEBUG. -->

	}

	tlsClientConfig := tls.Config{
		RootCAs:            s.RootCAs,
		CipherSuites:       s.CipherSuites,
		CurvePreferences:   s.CurvePreferences,
		ClientSessionCache: tls.NewLRUClientSessionCache(tlsClientSessionCacheSize),
	}

	// For more details about various values used here refer
	// https://golang.org/pkg/net/http/#Transport documentation

		t.Run(fmt.Sprintf("curve=%d", curveid), func(t *testing.T) {
			clientConfig := testConfig.Clone()
			clientConfig.CurvePreferences = []CurveID{curveid}
			if curveid == x25519Kyber768Draft00 {
				// x25519Kyber768Draft00 is not supported standalone.
				clientConfig.CurvePreferences = append(clientConfig.CurvePreferences, X25519)
			}
			if _, _, err := testHandshake(t, clientConfig, serverConfig); err != nil {

		}
		versions = append(versions, v)
	}
	return versions
}

func (c *Config) curvePreferences(version uint16) []CurveID {
	var curvePreferences []CurveID
	if c != nil && len(c.CurvePreferences) != 0 {
		curvePreferences = slices.Clone(c.CurvePreferences)
		if needFIPS() {
			return slices.DeleteFunc(curvePreferences, func(c CurveID) bool {
				return !slices.Contains(defaultCurvePreferencesFIPS, c)
			})
		}

		AuthRequest:  storageServerRequestValidate,
		BlockConnect: globalGridStart,
		TLSConfig: &tls.Config{
			RootCAs:          globalRootCAs,
			CipherSuites:     fips.TLSCiphers(),
			CurvePreferences: fips.TLSCurveIDs(),
		},
		// Record incoming and outgoing bytes.
		Incoming: globalConnStats.incInternodeInputBytes,
		Outgoing: globalConnStats.incInternodeOutputBytes,
		TraceTo:  globalTrace,
	})

	switch common_features.CompliancePolicy {
	case "":
		return
	case common_features.FIPS_140_2:
		ctx.MinVersion = gotls.VersionTLS12
		ctx.MaxVersion = gotls.VersionTLS12
		ctx.CipherSuites = fipsGoCiphers
		ctx.CurvePreferences = []gotls.CurveID{gotls.CurveP256}
		return
	default:
		log.Warnf("unknown compliance policy: %q", common_features.CompliancePolicy)
		return
	}
}

	return xhttp.ConnSettings{
		LookupHost:       globalDNSCache.LookupHost,
		DialTimeout:      rest.DefaultTimeout,
		RootCAs:          globalRootCAs,
		CipherSuites:     fips.TLSCiphers(),
		CurvePreferences: fips.TLSCurveIDs(),
		EnableHTTP2:      false,
		TCPOptions:       globalTCPOptions,
	}.NewInternodeHTTPTransport(maxIdleConnsPerHost)
}

// NewHTTPTransportWithClientCerts returns a new http configuration

		},
	}
	runServerTestTLS13(t, test)
}

// TestHandshakeServerKeySharePreference checks that we prefer a key share even
// if it's later in the CurvePreferences order.
func TestHandshakeServerKeySharePreference(t *testing.T) {
	config := testConfig.Clone()
	config.CurvePreferences = []CurveID{X25519, CurveP256}

	test := &serverTest{
		name:    "KeySharePreference",

	if len(*curves) != 0 {
		for _, curveStr := range *curves {
			id, err := strconv.Atoi(curveStr)
			if err != nil {
				log.Fatalf("failed to parse curve id %q: %s", curveStr, err)
			}
			cfg.CurvePreferences = append(cfg.CurvePreferences, CurveID(id))
		}
	}

	for i := 0; i < *resumeCount+1; i++ {
		if i > 0 && (*onResumeECHConfigListB64 != "") {
			echConfigList, err := base64.StdEncoding.DecodeString(*onResumeECHConfigListB64)

		},
		{
			name: "ClientCurvePreferences",
			clientConfig: func(config *Config) {
				config.CurvePreferences = []CurveID{X25519}
			},
			expectClientSupport: false,
		},
		{
			name: "ServerCurvePreferencesX25519",
			serverConfig: func(config *Config) {
				config.CurvePreferences = []CurveID{X25519}
			},
			expectClientSupport: true,
			expectKyber:         false,