)
    assertThat(cleaner.clean(list(certB, certA), "hostname")).isEqualTo(
      list(certB, certA, trusted, selfSigned),
    )
    assertThat(cleaner.clean(list(certB, certA, trusted), "hostname")).isEqualTo(
      list(certB, certA, trusted, selfSigned),
    )
    assertThat(cleaner.clean(list(certB, certA, trusted, selfSigned), "hostname"))
      .isEqualTo(
        list(certB, certA, trusted, selfSigned),

    }
  }

  /** Returns true if [certificate] matches [hostname]. */
  private fun verifyHostname(
    hostname: String,
    certificate: X509Certificate,
  ): Boolean {
    val hostname = hostname.asciiToLowercase()
    return getSubjectAltNames(certificate, ALT_DNS_NAME).any {
      verifyHostname(hostname, it)
    }
  }

  /**

      buildRequest(hostname, networkRequests, results, failures, DnsRecordCodec.TYPE_AAAA)
    }

    executeRequests(hostname, networkRequests, results, failures)

    return results.ifEmpty {
      throwBestFailure(hostname, failures)
    }
  }

  private fun buildRequest(
    hostname: String,
    networkRequests: MutableList<Call>,
    results: MutableList<InetAddress>,
    failures: MutableList<Exception>,
    type: Int,

  fun check(
    hostname: String,
    vararg peerCertificates: Certificate,
  ) {
    check(hostname, peerCertificates.toList())
  }

  /**
   * Returns list of matching certificates' pins for the hostname. Returns an empty list if the
   * hostname does not have pinned certificates.
   */
  fun findMatchingPins(hostname: String): List<Pin> = pins.filterList { matchesHostname(hostname) }

      Dns { hostname ->
        val allAddresses = mutableListOf<InetAddress>()
        val allExceptions = mutableListOf<IOException>()
        val latch = CountDownLatch(asyncDns.size)

        asyncDns.forEach {
          it.query(
            hostname,
            object : Callback {
              override fun onResponse(
                hostname: String,
                addresses: List<InetAddress>,

        .serialNumber(2L)
        .commonName(server.hostName)
        .addSubjectAlternativeName(server.hostName)
        .addSubjectAlternativeName("san.com")
        .addSubjectAlternativeName("*.wildcard.com")
        .addSubjectAlternativeName("differentdns.com")
        .build()
    serverIps = Dns.SYSTEM.lookup(server.hostName)
    dns[server.hostName] = serverIps
    dns["san.com"] = serverIps

    server: MockWebServer,
    @MockWebServerInstance("server2") server2: MockWebServer,
  ) {
    this.server1 = server
    this.server2 = server2

    socketFactory = SpecificHostSocketFactory(InetSocketAddress(server.hostName, server.port))

    client =
      clientTestRule.newClientBuilder()
        .dns(dns)
        .socketFactory(socketFactory)
        .eventListenerFactory(clientTestRule.wrap(listener))
        .build()
  }

     * a mechanism to trust some hosts and not others.
     *
     * @param hostname the exact hostname from the URL for insecure connections.
     */
    fun addInsecureHost(hostname: String) =
      apply {
        insecureHosts += hostname
      }

    fun build(): HandshakeCertificates {
      val immutableInsecureHosts = insecureHosts.toImmutableList()

      val inetAddress = socket.localAddress

      var hostname = inetAddress.hostName
      if (inetAddress is Inet6Address && hostname.contains(':')) {
        // hostname is likely some form representing the IPv6 bytes
        // 2001:0db8:85a3:0000:0000:8a2e:0370:7334
        // 2001:db8:85a3::8a2e:370:7334
        // ::1
        hostname = "[$hostname]"
      }

      val localPort = socket.localPort

  }

  private fun dnsQuery(hostname: String): Pair<List<InetAddress>, Exception?> {
    val allAddresses = mutableListOf<InetAddress>()
    var exception: Exception? = null
    val latch = CountDownLatch(1)

    // assumes an IPv4 address
    AndroidAsyncDns.IPv4.query(
      hostname,
      object : AsyncDns.Callback {
        override fun onResponse(
          hostname: String,