} else {
        assertThat(sessionIds[0]).isNotEmpty()
        assertThat(sessionIds[1]).isNotEmpty()

        assertThat(directSessionIds).containsExactlyInAnyOrder(sessionIds[1])
      }
    } else {
      if (tlsVersion == TlsVersion.TLS_1_3) {
        // We can't rely on the same session id with TLSv1.3 ids.
        assertNotEquals(sessionIds[0], sessionIds[1])

import okio.ByteString;

/**
 * Runs a MockWebServer on localhost and uses it as the backend to receive an OAuth session.
 *
 * <p>Clients should call {@link #start}, {@link #newAuthorizeUrl} and {@link #close} in that order.
 * Clients may request multiple sessions.
 */
public final class OAuthSessionFactory extends Dispatcher implements Closeable {
  private final SecureRandom secureRandom = new SecureRandom();

[versions]
biz-aQute-bnd = "6.4.0"
checkStyle = "10.15.0"
com-squareup-moshi = "1.15.1"
com-squareup-okio = "3.9.0"
de-mannodermaus-junit5 = "1.4.0"
graalvm = "22.3.2"
kotlinx-serialization = "1.6.3"
mockserverClient = "5.15.0"
org-bouncycastle = "1.76"
org-conscrypt = "2.5.2"
org-jetbrains-coroutines = "1.8.0"
org-jetbrains-kotlin = "1.9.23"
org-junit-jupiter = "5.10.2"
testcontainers = "1.19.7"

[libraries]

  @SuppressLint("NewApi")
  @IgnoreJRERequirement // This function is overridden to require API >= 24.
  open fun getHandshakeServerNames(sslSocket: SSLSocket): List<String> {
    val session = sslSocket.session as? ExtendedSSLSession ?: return listOf()
    return session.requestedServerNames.mapNotNull { (it as? SNIHostName)?.asciiName }
  }

  @Throws(IOException::class)
  open fun connectSocket(
    socket: Socket,

import java.security.cert.X509Certificate;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;

/**
 * Simple test adaptable to show a failure in older versions of OkHttp
 * or Android SDKs.
 */
@RunWith(AndroidJUnit4.class)
public class IssueReproductionTest {
  @Test public void getFailsWithoutAdditionalCert() throws IOException {
    OkHttpClient client = new OkHttpClient();

   * OkHttp in the current runtime. Use this to include the OkHttp version in custom `User-Agent`
   * headers.
   *
   * Official OkHttp releases follow [semantic versioning][semver]. Versions with the `-SNAPSHOT`
   * qualifier are not unique and should only be used in development environments. If you create
   * custom builds of OkHttp please include a qualifier your version name, like "4.7.0-mycompany.3".

import org.junit.Test

/**
 * Simplified from
 * https://hc.apache.org/httpcomponents-client-5.0.x/httpclient5/examples/AsyncClientTlsAlpn.java
 *
 * Mainly intended to verify behaviour of popular clients across Android versions, similar
 * to observing Firefox or Chrome browser behaviour.
 */
class ApacheHttpClientHttp2Test {
  @Test
  fun testHttp2() {
    val client = HttpAsyncClients.createHttp2Default()

    client.use { client ->

## Version 4.8.1

_2020-08-06_

 *  Fix: Don't crash in `HeldCertificate.Builder` when creating certificates on older versions of
    Android, including Android 6. We were using a feature of `SimpleDateFormat` that wasn't
    available in those versions!


## Version 4.8.0

_2020-07-11_

 *  New: Change `HeldCertificate.Builder` to use its own ASN.1 certificate encoder. This is part

 *  Fix: Don't leak connections when using ALPN on the desktop.
 *  Fix: Update Jetty ALPN to `7.1.2.v20141202` (Java 7) and `8.1.2.v20141202` (Java 8).
    This fixes a bug in resumed TLS sessions where the wrong protocol could be
    selected.
 *  Fix: Don't crash in SPDY and HTTP/2 when disconnecting before connecting.
 *  Fix: Avoid a reverse DNS-lookup for a numeric proxy address

    not send the `Expect: continue` request header.
 *  Fix: Do not count web sockets toward the dispatcher's per-host connection
    limit.
 *  Fix: Avoid using invalid HTTPS sessions. This prevents OkHttp from crashing
    with the error, `Unexpected TLS version: NONE`.
 *  Fix: Don't corrupt the response cache when a 304 (Not Modified) response
    overrides the stored "Content-Encoding" header.