|
      """.trimMargin()
    val pkcs8Pem =
      """
      |-----BEGIN PRIVATE KEY-----
      |MEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCA7ODT0xhGSNn4ESj6J
      |lu/GJQZoU9lDrCPeUcQ28tzOWw==
      |-----END PRIVATE KEY-----
      |
      """.trimMargin()
    val bcPkcs8Pem =
      """
      |-----BEGIN PRIVATE KEY-----
      |ME0CAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEMzAxAgEBBCA7ODT0xhGSNn4ESj6J

  val decoded = Punycode.decode(bufferA.readUtf8()) ?: return null

  // 4.1 Validate.

  // Must be NFC.
  if (decoded != normalizeNfc(decoded)) return null

  // TODO: Must not begin with a combining mark.
  // TODO: Each character must be 'valid' or 'deviation'. Not mapped.
  // TODO: CheckJoiners from IDNA 2008
  // TODO: CheckBidi from IDNA 2008, RFC 5893, Section 2.

    string containing both a certificate and PKCS #8-encoded private key.

    ```kotlin
    val heldCertificate = HeldCertificate.decode("""
        |-----BEGIN CERTIFICATE-----
        |MIIBYTCCAQegAwIBAgIBKjAKBggqhkjOPQQDAjApMRQwEgYDVQQLEwtlbmdpbmVl
        |cmluZzERMA8GA1UEAxMIY2FzaC5hcHAwHhcNNzAwMTAxMDAwMDA1WhcNNzAwMTAx

 * limitations under the License.
 */
package mockwebserver3

import okhttp3.ExperimentalOkHttpApi

/**
 * Handles a call's stream directly. Use this instead of [MockResponseBody] to begin sending
 * response data before all request data has been received.
 *
 * See [okhttp3.RequestBody.isDuplex].
 */
@ExperimentalOkHttpApi
interface StreamHandler {
  fun handle(stream: Stream)

PEM files
---------

You can encode a `HeldCertificate` in PEM format:

```java
HeldCertificate heldCertificate = ...
System.out.println(heldCertificate.certificatePem())
```

```
-----BEGIN CERTIFICATE-----
MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMC8xLTArBgNVBAMTJDJiYWY3NzVl
LWE4MzUtNDM5ZS1hYWE2LTgzNmNiNDlmMGM3MTAeFw0xODA3MTMxMjA0MzJaFw0x
ODA3MTQxMjA0MzJaMC8xLTArBgNVBAMTJDJiYWY3NzVlLWE4MzUtNDM5ZS1hYWE2

      |jaA9VEhgdaVhxBsT2qzUNDsXlOzGsliznDfoqETb
      |
      """.trimMargin()
    val certificateByteString = certificateBase64.decodeBase64()!!
    val certificatePem =
      """
      |-----BEGIN CERTIFICATE-----
      |$certificateBase64
      |-----END CERTIFICATE-----
      |
      """.trimMargin()

    val javaCertificate = certificatePem.decodeCertificatePem()
    val okHttpCertificate =

// Repl.it : https://repl.it
// Submitted by Lincoln Bergeson <******@****.***>
firewalledreplit.co
id.firewalledreplit.co
repl.co
id.repl.co
repl.run

// Resin.io : https://resin.io
// Submitted by Tim Perry <tim@resin.io>
resindevice.io
devices.resinstaging.io

// RethinkDB : https://www.rethinkdb.com/
// Submitted by Chris Kastorff <******@****.***>
hzc.io

1D165..1D172  ; valid                  ;      ; NV8    # 3.1  MUSICAL SYMBOL COMBINING STEM..MUSICAL SYMBOL COMBINING FLAG-5
1D173..1D17A  ; disallowed                             # 3.1  MUSICAL SYMBOL BEGIN BEAM..MUSICAL SYMBOL END PHRASE
1D17B..1D1BA  ; valid                  ;      ; NV8    # 3.1  MUSICAL SYMBOL COMBINING ACCENT..MUSICAL SYMBOL SEMIBREVIS BLACK

  // Typically developers will need to get a PEM file from their organization's TLS administrator.
  final X509Certificate comodoRsaCertificationAuthority = Certificates.decodeCertificatePem(""
      + "-----BEGIN CERTIFICATE-----\n"
      + "MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCB\n"
      + "hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G\n"

  companion object {
    private val PEM_REGEX = Regex("""-----BEGIN ([!-,.-~ ]*)-----([^-]*)-----END \1-----""")

    /**
     * Decodes a multiline string that contains both a [certificate][certificatePem] and a
     * [private key][privateKeyPkcs8Pem], both [PEM-encoded][rfc_7468]. A typical input string looks
     * like this:
     *
     * ```
     * -----BEGIN CERTIFICATE-----