it keeps your `HeldCertificate` and its chain. On the client it keeps the root certificates
    that are trusted to sign a server's certificate chain. `HandshakeCertificates` also works with
    mutual TLS where these roles are reversed.

    These classes make it possible to enable HTTPS in MockWebServer in [just a few lines of
    code][https_server_sample].

  @RegisterExtension
  val platform = PlatformRule()
  private lateinit var server: MockWebServer

  @RegisterExtension
  val clientTestRule = OkHttpClientTestRule()

  private val listener = EventSourceRecorder()
  private val client = clientTestRule.newClient()

  @BeforeEach
  fun before(server: MockWebServer) {
    this.server = server
  }

  @AfterEach
  fun after() {
    listener.assertExhausted()
  }

 * Sec-WebSocket-Extensions: permessage-deflate; server_max_window_bits="15"
 * Sec-WebSocket-Extensions: permessage-deflate; server_max_window_bits=15
 * Sec-WebSocket-Extensions: permessage-deflate; server_no_context_takeover
 * Sec-WebSocket-Extensions: permessage-deflate; server_no_context_takeover;
 *     client_no_context_takeover
 * Sec-WebSocket-Extensions: permessage-deflate; server_max_window_bits="15";

  private fun setLevel(level: Level) {
    networkInterceptor.setLevel(level)
    applicationInterceptor.setLevel(level)
  }

  @BeforeEach
  fun setUp(server: MockWebServer) {
    this.server = server
    client =
      OkHttpClient.Builder()
        .addNetworkInterceptor(
          Interceptor { chain ->
            when {

    private var started = false

    fun server(name: String): MockWebServer {
      return servers.getOrPut(name) {
        MockWebServer().also {
          if (started) it.start()
        }
      }
    }

    fun startAll() {
      started = true
      for (server in servers.values) {
        server.start()
      }
    }

    fun shutdownAll() {
      try {

    return InetSocketAddress(serverAddress, serverSocket!!.localPort)
  }

  private fun doServerHandshake(server: HandshakeCertificates): Future<Handshake> {
    return executorService.submit<Handshake> {
      serverSocket!!.accept().use { rawSocket ->
        val sslSocket =
          server.sslSocketFactory().createSocket(
            rawSocket,
            rawSocket.inetAddress.hostAddress,

  val expectedModernTls13CipherSuites = listOf(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384)

  @BeforeEach
  fun setup(server: MockWebServer) {
    this.server = server

    server.enqueue(MockResponse())

    client =
      clientTestRule.newClientBuilder()
        .sslSocketFactory(
          handshakeCertificates.sslSocketFactory(),

   * received without TLS.
   */
  val handshake: Handshake?
  val requestUrl: HttpUrl?

  /**
   * Returns the name of the server the client requested via the SNI (Server Name Indication)
   * attribute in the TLS handshake. Unlike the rest of the HTTP exchange, this name is sent in
   * cleartext and may be monitored or blocked by a proxy or other middlebox.
   */

 * follow-up requests. The client is unblocked and free to continue as soon as it has received the
 * entire response body. If and when the client makes a subsequent request using a pooled socket the
 * server may not have had time to close the socket. The socket will be closed at an indeterminate
 * point before or during the second request. It may be closed after client has started sending the

#### Shared reader thread