assertThat(CertificateAdapters.extension.toDer(extension))
      .isEqualTo(bytes)
    assertThat(CertificateAdapters.extension.fromDer(bytes))
      .isEqualTo(extension)
  }

  /** Tags larger than 30 are a special case. */
  @Test fun `large tag`() {
    val bytes = "df83fb6800".decodeHex()

    val adapter = Adapters.NULL.withTag(tagClass = DerHeader.TAG_CLASS_PRIVATE, tag = 65_000L)

      MockResponse(
        code = 401,
        headers = headersOf("WWW-Authenticate", "Bearer realm=\"oauthed\""),
        body = "Please authenticate.",
      ),
    )
    server.enqueue(
      MockResponse(body = "A"),
    )
    val authenticator = RecordingOkAuthenticator("oauthed abc123", "Bearer")
    client =
      client.newBuilder()
        .authenticator(authenticator)
        .build()

    compressing outbound web socket messages. Configure this with 0L to always compress outbound
    messages and `Long.MAX_VALUE` to never compress outbound messages. The default is 1024L which
    compresses messages of size 1 KiB and larger. (Inbound messages are compressed or not based on
    the web socket server's configuration.)
 *  New: Defer constructing `Inflater` and `Deflater` instances until they are needed. This saves

        .build()
    val cleaner = get(root.certificate)
    assertThat(cleaner.clean(list(root), "hostname")).isEqualTo(list(root))
  }

  @Test
  fun normalizeUnknownSelfSignedCertificate() {
    val root =
      HeldCertificate.Builder()
        .serialNumber(1L)
        .build()
    val cleaner = get()
    assertFailsWith<SSLPeerUnverifiedException> {
      cleaner.clean(list(root), "hostname")
    }
  }

 *
 * This class may be used to stream very large responses. For example, it is possible to use this
 * class to read a response that is larger than the entire memory allocated to the current process.
 * It can even stream a response larger than the total storage on the current device, which is a
 * common requirement for video streaming applications.
 *

    // All other connections created will expire sooner
    routePlanner.defaultConnectionIdleAtNanos = expireSooner

    // Turn it into an http/2 connection that supports 5 concurrent streams
    // which can satisfy a larger policy
    val connection = routePlanner.plans.first().connection
    val http2Connection = connectHttp2(peer, connection, 5)
    setPolicy(pool, address, ConnectionPool.AddressPolicy(5))

    assertThat(hpackReader!!.getAndResetHeaderList()).isEqualTo(headerBlock)
  }

  /**
   * HPACK has a max header table size, which can be smaller than the max header message. Ensure the
   * larger header content is not lost.
   */
  @Test
  fun tooLargeToHPackIsStillEmitted() {
    bytesIn.writeByte(0x21) // Dynamic table size update (size = 1).
    bytesIn.writeByte(0x00) // Literal indexed

 * certificate is signed by the certificate that follows, and the last certificate is a trusted CA
 * certificate.
 *
 * Use of the chain cleaner is necessary to omit unexpected certificates that aren't relevant to
 * the TLS handshake and to extract the trusted CA certificate for the benefit of certificate
 * pinning.
 */
abstract class CertificateChainCleaner {

import java.security.cert.Certificate
import java.security.cert.X509Certificate
import java.util.ArrayDeque
import java.util.Deque
import javax.net.ssl.SSLPeerUnverifiedException

/**
 * A certificate chain cleaner that uses a set of trusted root certificates to build the trusted
 * chain. This class duplicates the clean chain building performed during the TLS handshake. We
 * prefer other mechanisms where they exist, such as with

  internal const val OPCODE_CONTROL_CLOSE = 0x8
  internal const val OPCODE_CONTROL_PING = 0x9
  internal const val OPCODE_CONTROL_PONG = 0xa

  /**
   * Maximum length of frame payload. Larger payloads, if supported by the frame type, can use the
   * special values [PAYLOAD_SHORT] or [PAYLOAD_LONG].
   */
  internal const val PAYLOAD_BYTE_MAX = 125L

  /** Maximum length of close message in bytes. */