* Keep whichever TCP connection succeeds first and cancel all the others.
 * Race TCP only. Only attempt a TLS handshake on the winning TCP connection.

    assertThat(request.url.scheme).isEqualTo("https")
    val handshake = request.handshake
    assertThat(handshake!!.tlsVersion).isNotNull()
    assertThat(handshake.cipherSuite).isNotNull()
    assertThat(handshake.localPrincipal).isNotNull()
    assertThat(handshake.localCertificates.size).isEqualTo(1)
    assertThat(handshake.peerPrincipal).isNull()
    assertThat(handshake.peerCertificates.size).isEqualTo(0)
  }

  @Test

  override fun secureConnectStart(call: Call) = logEvent(SecureConnectStart(System.nanoTime(), call))

  override fun secureConnectEnd(
    call: Call,
    handshake: Handshake?,
  ) = logEvent(SecureConnectEnd(System.nanoTime(), call, handshake))

  override fun connectEnd(
    call: Call,
    inetSocketAddress: InetSocketAddress,
    proxy: Proxy,
    protocol: Protocol?,

  fun removePlanToCancel(connectPlan: ConnectPlan)

  fun updateRouteDatabaseAfterSuccess(route: Route)

  fun connectStart(route: Route)

  fun secureConnectStart()

  fun secureConnectEnd(handshake: Handshake?)

  fun callConnectEnd(
    route: Route,
    protocol: Protocol?,
  )

  fun connectionConnectEnd(
    connection: Connection,
    route: Route,
  )

  fun connectFailed(

    try (Response response = client.newCall(request).execute()) {
      assertTrue(response.code() == 200 || response.code() == 404);
      assertEquals(Protocol.HTTP_2, response.protocol());

      for (Certificate c: response.handshake().peerCertificates()) {
        X509Certificate x = (X509Certificate) c;
        System.out.println(x.getSubjectDN());
      }
    }
  }

    logWithTime("secureConnectStart")

    delegate.secureConnectStart(call)
  }

  override fun secureConnectEnd(
    call: Call,
    handshake: Handshake?,
  ) {
    logWithTime("secureConnectEnd: $handshake")

    delegate.secureConnectEnd(call, handshake)
  }

  override fun connectEnd(
    call: Call,
    inetSocketAddress: InetSocketAddress,
    proxy: Proxy,
    protocol: Protocol?,

        .build();

    Call call = client.newCall(new Request.Builder()
        .url(server.url("/"))
        .build());
    Response response = call.execute();
    System.out.println(response.handshake().tlsVersion());
  }

  public static void main(String... args) throws Exception {
    new HttpsServer().run();
  }

    .build();
```

### Debugging TLS Handshake Failures

The TLS handshake requires clients and servers to share a common TLS version and cipher suite. This
depends on the JVM or Android version, OkHttp version, and web server configuration. If there is no
common cipher suite and TLS version, your call will fail like this:

```
Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x7f2719a89e80:

  private val retryableException = SSLHandshakeException("Simulated handshake exception")

  @RegisterExtension
  val clientTestRule = OkHttpClientTestRule()

  private var client = clientTestRule.newClient()

  @AfterEach internal fun tearDown() {
    factory.close()
  }

  @Test fun nonRetryableIOException() {
    val exception = IOException("Non-handshake exception")
    assertThat(retryTlsHandshake(exception)).isFalse()
  }

 * certificate is signed by the certificate that follows, and the last certificate is a trusted CA
 * certificate.
 *
 * Use of the chain cleaner is necessary to omit unexpected certificates that aren't relevant to
 * the TLS handshake and to extract the trusted CA certificate for the benefit of certificate
 * pinning.
 */
abstract class CertificateChainCleaner {
  @Throws(SSLPeerUnverifiedException::class)
  abstract fun clean(