java-version: 17

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Run Checks
        run: ./gradlew okhttp:test -Dokhttp.platform=bouncycastle

  testcorretto:
    runs-on: ubuntu-latest
    # TODO add master build after fixing all tests in CI
    if: contains(github.event.pull_request.labels.*.name, 'providers')

    steps:

 *  New: `Headers.Builder` now accepts dates.
 *  New: OkHttp now accepts `java.time.Duration` for timeouts on Java 8+ and Android 26+.
 *  New: `Challenge` includes all authentication parameters.
 *  New: Upgrade to BouncyCastle 1.60, Conscrypt 1.4.0, and Okio 1.15.0. We don't yet require
    Kotlin-friendly Okio 2.x but OkHttp works fine with that series.

    ```kotlin
    implementation("org.bouncycastle:bcprov-jdk15on:1.60")

import okhttp3.testing.Flaky
import okhttp3.testing.PlatformRule
import okio.Buffer
import okio.BufferedSink
import okio.GzipSink
import okio.buffer
import okio.utf8Size
import org.bouncycastle.tls.TlsFatalAlert
import org.junit.jupiter.api.AfterEach
import org.junit.jupiter.api.BeforeEach
import org.junit.jupiter.api.Disabled
import org.junit.jupiter.api.Tag
import org.junit.jupiter.api.Test

      keyStore.setKeyEntry("private", heldCertificate.keyPair.private, password, chain)
    }

    // https://github.com/bcgit/bc-java/issues/1160
    val isBouncyCastle = keyStore.provider.name == "BC"
    val algorithm = if (isBouncyCastle) "PKIX" else KeyManagerFactory.getDefaultAlgorithm()

    val factory = KeyManagerFactory.getInstance(algorithm)
    factory.init(keyStore, password)

    val response = call.execute()
    assertThat(response.isSuccessful).isTrue()

    val recordedRequest = server.takeRequest()
    // https://github.com/bcgit/bc-java/issues/1773
    if (!platform.isBouncyCastle()) {
      assertThat(recordedRequest.handshakeServerNames).containsExactly(url.host)
    }
  }

  /**
   * Use different hostnames for the TLS handshake (including SNI) and the HTTP request (in the