fail<Any>()
    } catch (expected: IllegalArgumentException) {
      assertThat(expected.message).isEqualTo("string does not include a private key")
    }
    try {
      decode(pkcs8Pem)
      fail<Any>()
    } catch (expected: IllegalArgumentException) {
      assertThat(expected.message).isEqualTo("string does not include a certificate")
    }
    try {
      decode(certificatePem + pkcs8Pem + certificatePem)

    this one.
 *  New: Include suppressed exceptions when all routes to a target service fail.


## Version 4.4.1

_2020-03-08_

 *  Fix: Don't reuse a connection on redirect if certs match but DNS does not. For better
    locality and performance OkHttp attempts to use the same pooled connection across redirects and
    follow-ups. It independently shares connections when the IP addresses and certificates match,

  /** The low-level TCP socket. */
  private var rawSocket: Socket?,
  /**
   * The application layer socket. Either an [SSLSocket] layered over [rawSocket], or [rawSocket]
   * itself if this connection does not use SSL.
   */
  private var socket: Socket?,
  private var handshake: Handshake?,
  private var protocol: Protocol?,
  private var source: BufferedSource?,
  private var sink: BufferedSink?,

      }

    /**
     * Add a header with the specified name and value. Does validation of header names and values.
     */
    fun add(
      name: String,
      value: String,
    ) = commonAdd(name, value)

    /**
     * Add a header with the specified name and value. Does validation of header names, allowing
     * non-ASCII values.
     */
    fun addUnsafeNonAscii(

  /** The low-level TCP socket. */
  private var rawSocket: Socket? = null

  /**
   * The application layer socket. Either an [SSLSocket] layered over [rawSocket], or [rawSocket]
   * itself if this connection does not use SSL.
   */
  internal var socket: Socket? = null
  private var handshake: Handshake? = null
  private var protocol: Protocol? = null
  private var source: BufferedSource? = null

 * of Android's private InetAddress#isNumeric API.
 *
 * This matches IPv6 addresses as a hex string containing at least one colon, and possibly
 * including dots after the first colon. It matches IPv4 addresses as strings containing only
 * decimal digits and dots. This pattern matches strings like "a:.23" and "54" that are neither IP
 * addresses nor hostnames; they will be verified as IP addresses (which is a more strict
 * verification).

  fun retryAfterFailure(): Boolean {
    return exchange?.hasFailure == true &&
      exchangeFinder!!.routePlanner.hasNext(exchange?.connection)
  }

  /**
   * Returns a string that describes this call. Doesn't include a full URL as that might contain
   * sensitive information.
   */
  private fun toLoggableString(): String {
    return (
      (if (isCanceled()) "canceled " else "") +

  val pins: Set<Pin>,
  internal val certificateChainCleaner: CertificateChainCleaner? = null,
) {
  /**
   * Confirms that at least one of the certificates pinned for `hostname` is in `peerCertificates`.
   * Does nothing if there are no certificates pinned for `hostname`. OkHttp calls this after a
   * successful TLS handshake, but before the connection is used.
   *

          else -> {
            throw IllegalArgumentException("unexpected type: $label")
          }
        }
      }
      require(certificatePem != null) { "string does not include a certificate" }
      require(pkcs8Base64 != null) { "string does not include a private key" }

      return decode(certificatePem, pkcs8Base64)
    }

    private fun decode(
      certificatePem: String,

    ) = apply {
      headers.add(name, value.toString())
    }

    /**
     * Adds a new header with the name and value. This may be used to add multiple headers with the
     * same name. Unlike [addHeader] this does not validate the name and
     * value.
     */
    fun addHeaderLenient(
      name: String,
      value: Any,
    ) = apply {
      addHeaderLenient(headers, name, value.toString())
    }