.tlsVersions(TlsVersion.TLS_1_3, TlsVersion.TLS_1_2)
        .supportsTlsExtensions(true)
        .build()

    /**
     * A modern TLS configuration that works on most client platforms and can connect to most servers.
     * This is OkHttp's default configuration.
     */
    @JvmField
    val MODERN_TLS =
      Builder(true)
        .cipherSuites(*APPROVED_CIPHER_SUITES.toTypedArray())

 *    multiple domain names.
 *
 *  * Application Layer Protocol Negotiation (ALPN) enables the HTTPS port (443) to be used to
 *    negotiate HTTP/2.
 *
 * Unfortunately, older HTTPS servers refuse to connect when such options are presented. Rather than
 * avoiding these options entirely, this class allows a connection to be attempted with modern
 * options and then retried without them should the attempt fail.
 *

   */
  fun cancel()

  fun interface Factory {
    /**
     * Creates a new web socket and immediately returns it. Creating a web socket initiates an
     * asynchronous process to connect the socket. Once that succeeds or fails, `listener` will be
     * notified. The caller must either close or cancel the returned web socket when it is no longer
     * in use.
     */
    fun newWebSocket(

  internal var hasFailure: Boolean = false
    private set

  internal val connection: RealConnection
    get() = codec.carrier as? RealConnection ?: error("no connection for CONNECT tunnels")

  internal val isCoalescedConnection: Boolean
    get() = finder.routePlanner.address.url.host != codec.carrier.route.address.url.host

  @Throws(IOException::class)

    .build();
OkHttpClient client = new OkHttpClient.Builder()
    .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager())
    .build();

// Connect 'em all together. Certificates are exchanged in the handshake.
Call call = client.newCall(new Request.Builder()
    .url(server.url("/"))
    .build());
Response response = call.execute();

      client.newBuilder()
        .sslSocketFactory(
          handshakeCertificates2.sslSocketFactory(),
          handshakeCertificates2.trustManager,
        )
        .build()

    // This client fails to connect because the new SSL socket factory refuses.
    assertFailsWith<IOException> {
      anotherClient.newCall(request).execute()
    }.also { expected ->
      when (expected) {

    assert200Http2Response(execute(sanUrl), "san.com")
    assertThat(client.connectionPool.connectionCount()).isEqualTo(1)
  }

  /** Certificate pinning used and not a match will avoid coalescing and try to connect.  */
  @Test
  fun skipsWhenCertificatePinningFails() {
    val pinner =
      CertificatePinner.Builder()
        .add("san.com", "sha1/afwiKY3RxoMmLkuRW1l7QsPZTJPwDS2pdDROQjXw8ig=")
        .build()

    connection.requestMethod = "POST"
    connection.doOutput = true
    connection.setFixedLengthStreamingMode(1024 * 1024 * 1024) // 1 GB
    connection.connect()
    val out = connection.outputStream
    val data = ByteArray(1024 * 1024)
    var i = 0
    while (i < 1024) {
      try {
        out!!.write(data)
        out.flush()
        if (i == 513) {

onion

// org : https://en.wikipedia.org/wiki/.org
org

// pa : http://www.nic.pa/
// Some additional second level "domains" resolve directly as hostnames, such as
// pannet.pa, so we add a rule for "pa".
pa
ac.pa
gob.pa
com.pa
org.pa
sld.pa
edu.pa
net.pa
ing.pa
abo.pa
med.pa
nom.pa