fail<Any>()
    } catch (expected: IllegalArgumentException) {
      assertThat(expected.message).isEqualTo("string does not include a private key")
    }
    try {
      decode(pkcs8Pem)
      fail<Any>()
    } catch (expected: IllegalArgumentException) {
      assertThat(expected.message).isEqualTo("string does not include a certificate")
    }
    try {
      decode(certificatePem + pkcs8Pem + certificatePem)

 *  Fix: Limit retry attempts for HTTP/2 `REFUSED_STREAM` and `CANCEL` failures.
 *  Fix: Retry automatically when incorrectly sharing a connection among multiple hostnames. OkHttp
    shares connections when hosts share both IP addresses and certificates, such as `squareup.com`
    and `www.squareup.com`. If a server refuses such sharing it will return HTTP 421 and OkHttp will
    automatically retry on an unshared connection.

   * the already-requested ones are in service, otherwise we might create more threads than we need.
   *
   * We use [executeCallCount] and [runCallCount] to defend against starting more threads than we
   * need. Both fields are guarded by [lock].
   */
  private var executeCallCount = 0
  private var runCallCount = 0

    val cleaner = get(root)
    assertFailsWith<SSLPeerUnverifiedException> {
      cleaner.clean(certificates, "hostname")
    }
  }

  /** Returns a chain starting at the leaf certificate and progressing to the root.  */
  private fun chainOfLength(length: Int): List<HeldCertificate> {
    val result = mutableListOf<HeldCertificate>()
    for (i in 1..length) {
      result.add(

  }

  private fun certificateSANs(peerCertificate: X509Certificate): List<String> {
    return when (val subjectAlternativeNames = peerCertificate.subjectAlternativeNames) {
      null -> listOf()
      else -> subjectAlternativeNames.map { c: List<*> -> c[1] as String }
    }
  }

  @Test fun replacementCharacter() {
    // $ cat ./cert.cnf
    // [req]

    // At this point we don't have a hostname match. But we still be able to carry the request if
    // our connection coalescing requirements are met. See also:
    // https://hpbn.co/optimizing-application-delivery/#eliminate-domain-sharding
    // https://daniel.haxx.se/blog/2016/08/18/http2-connection-coalescing/

    // 1. This connection must be HTTP/2.
    if (http2Connection == null) return false

    // 2. The routes must share an IP address.

    private var notAfter = -1L
    private var commonName: String? = null
    private var organizationalUnit: String? = null
    private val altNames = mutableListOf<String>()
    private var serialNumber: BigInteger? = null
    private var keyPair: KeyPair? = null
    private var signedBy: HeldCertificate? = null
    private var maxIntermediateCas = -1
    private var keyAlgorithm: String? = null
    private var keySize: Int = 0

 * configured for testing.
 */
class OkHttpClientTestRule : BeforeEachCallback, AfterEachCallback {
  private val clientEventsList = mutableListOf<String>()
  private var testClient: OkHttpClient? = null
  private var uncaughtException: Throwable? = null
  private lateinit var testName: String
  private var defaultUncaughtExceptionHandler: Thread.UncaughtExceptionHandler? = null
  private var taskQueuesWereIdle: Boolean = false

    private var servedDate: Date? = null
    private var servedDateString: String? = null

    /** The last modified date of the cached response, if known. */
    private var lastModified: Date? = null
    private var lastModifiedString: String? = null

    /**
     * The expiration date of the cached response, if known. If both this field and the max age are

   * See [ConnectionPool].
   */
  open fun dnsStart(
    call: Call,
    domainName: String,
  ) {
  }

  /**
   * Invoked immediately after a DNS lookup.
   *
   * This method is invoked after [dnsStart].
   */
  open fun dnsEnd(
    call: Call,
    domainName: String,
    inetAddressList: List<@JvmSuppressWildcards InetAddress>,
  ) {
  }

  /**