?.value
    }

  val subjectAlternativeNames: Extension?
    get() {
      return tbsCertificate.extensions.firstOrNull {
        it.id == ObjectIdentifiers.SUBJECT_ALTERNATIVE_NAME
      }
    }

  val basicConstraints: Extension
    get() {
      return tbsCertificate.extensions.first {
        it.id == ObjectIdentifiers.BASIC_CONSTRAINTS
      }
    }

      null, "" -> null
      else -> protocol
    }
  }

  override fun configureTlsExtensions(
    sslSocket: SSLSocket,
    hostname: String?,
    protocols: List<Protocol>,
  ) {
    // No TLS extensions if the socket class is custom.
    if (matchesSocket(sslSocket)) {
      val bcSocket = sslSocket as BCSSLSocket

      val sslParameters = bcSocket.parameters

      // Enable ALPN.

 * Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits=15
 * Sec-WebSocket-Extensions: permessage-deflate; client_no_context_takeover
 * Sec-WebSocket-Extensions: permessage-deflate; server_max_window_bits="15"
 * Sec-WebSocket-Extensions: permessage-deflate; server_max_window_bits=15
 * Sec-WebSocket-Extensions: permessage-deflate; server_no_context_takeover
 * Sec-WebSocket-Extensions: permessage-deflate; server_no_context_takeover;

      if (e.javaClass.name != "java.lang.reflect.InaccessibleObjectException") {
        throw e
      }

      null
    }
  }

  /**
   * Configure TLS extensions on `sslSocket` for `route`.
   */
  open fun configureTlsExtensions(
    sslSocket: SSLSocket,
    hostname: String?,
    protocols: List<@JvmSuppressWildcards Protocol>,
  ) {
  }

      val extensions =
        try {
          X509TrustManagerExtensions(trustManager)
        } catch (iae: IllegalArgumentException) {
          // X509TrustManagerExtensions checks for checkServerTrusted(X509Certificate[], String, String)
          null
        }

      return when {
        extensions != null -> AndroidCertificateChainCleaner(trustManager, extensions)
        else -> null
      }
    }

  @Test fun subjectAltUsesLocalDomainAndIp() {
    // cat cert.cnf
    // [req]
    // distinguished_name=distinguished_name
    // req_extensions=req_extensions
    // x509_extensions=x509_extensions
    // [distinguished_name]
    // [req_extensions]
    // [x509_extensions]
    // subjectAltName=DNS:localhost.localdomain,DNS:localhost,IP:127.0.0.1
    //

        bytesRemainingInChunk = source.readHexadecimalUnsignedLong()
        val extensions = source.readUtf8LineStrict().trim()
        if (bytesRemainingInChunk < 0L || extensions.isNotEmpty() && !extensions.startsWith(";")) {
          throw ProtocolException(
            "expected chunk size and optional extensions" +
              " but was \"$bytesRemainingInChunk$extensions\"",
          )
        }
      } catch (e: NumberFormatException) {

        ),
      )
  }

  @Test
  fun multiplePerMessageDeflateHeaders() {
    val extensions =
      WebSocketExtensions.parse(
        headersOf(
          "Sec-WebSocket-Extensions",
          "",
          "Sec-WebSocket-Extensions",
          "permessage-deflate",
        ),
      )
    assertThat(extensions)
      .isEqualTo(
        WebSocketExtensions(
          perMessageDeflate = true,
        ),

            return
          }

          // Apply the extensions. If they're unacceptable initiate a graceful shut down.
          // TODO(jwilson): Listeners should get onFailure() instead of onClosing() + onClosed(1010).
          val extensions = WebSocketExtensions.parse(response.headers)
          this@RealWebSocket.extensions = extensions
          if (!extensions.isValid()) {
            synchronized(this@RealWebSocket) {

      return Validity(
        notBefore = notBefore,
        notAfter = notAfter,
      )
    }

    private fun extensions(): MutableList<Extension> {
      val result = mutableListOf<Extension>()

      if (maxIntermediateCas != -1) {
        result +=
          Extension(
            id = BASIC_CONSTRAINTS,
            critical = true,
            value =
              BasicConstraints(