}
	if err == nil && dnsURL != "" {
		bootstrapTraceMsg("initialize remote bucket DNS store")
		globalDNSConfig, err = dns.NewOperatorDNS(dnsURL,
			dns.Authentication(dnsUser, dnsPass),
			dns.RootCAs(globalRootCAs))
		if err != nil {
			configLogIf(ctx, fmt.Errorf("Unable to initialize remote webhook DNS config %w", err))
		}
	}

 *
 *  * A DNS lookup failed
 *  * The configuration is incapable of carrying the request, such as when the client is configured
 *    to use `H2_PRIOR_KNOWLEDGE` but the URL's scheme is `https:`.
 *  * Preemptive proxy authentication failed.
 *
 * Planning failures are not necessarily fatal. For example, even if we can't DNS lookup the first

```

#### 3.2.3 Generate a self-signed certificate

Create a file named `openssl.conf` with the content below. Set `IP.1` and/or `DNS.1` to point to the correct IP/DNS addresses:

```sh
[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
C = US
ST = VA
L = Somewhere
O = MyOrg

   * address for all hosts, regardless of the actual number of IP addresses reported by DNS.
   */
  fun newClient(): OkHttpClient {
    var client = testClient
    if (client == null) {
      client =
        initialClientBuilder()
          .dns(SINGLE_INET_ADDRESS_DNS) // Prevent unexpected fallback addresses.

    # Either the 'source' or 'remote' *must* be the "local" deployment
#    endpoint: "http://127.0.0.1:9000"
#    # path: "on|off|auto" # "on" enables path-style bucket lookup. "off" enables virtual host (DNS)-style bucket lookup. Defaults to "auto"
#    credentials:
#      accessKey: minioadmin # Required
#      secretKey: minioadmin # Required

  @AfterEach
  fun tearDown() {
    factory.close()
  }

  @Test @Disabled
  fun address() {
    val address: Address = factory.newAddress()
    val url: HttpUrl = address.url()
    val dns: Dns = address.dns()
    val socketFactory: SocketFactory = address.socketFactory()
    val proxyAuthenticator: Authenticator = address.proxyAuthenticator()
    val protocols: List<Protocol> = address.protocols()

ドメイン名の話はHTTPSに関する話のはるか前にありますが、すべてがドメインとIPアドレスに依存するため、ここで言及する価値があります。

///

### DNS { #dns }

では、実際のHTTPSの部分に注目してみましょう。

まず、ブラウザは**DNSサーバー**に**ドメインに対するIP**が何であるかを確認します。今回は、`someapp.example.com`とします。

DNSサーバーは、ブラウザに特定の**IPアドレス**を使用するように指示します。このIPアドレスは、DNSサーバーで設定した、あなたのサーバーが使用するパブリックIPアドレスになります。

<img src="/img/deployment/https/https01.drawio.svg">

### TLS Handshake の開始 { #tls-handshake-start }

ブラウザはIPアドレスと**ポート443**（HTTPSポート）で通信します。

private fun runBatch(
  dnsProviders: List<DnsOverHttps>,
  names: List<String>,
) {
  var time = System.currentTimeMillis()
  for (dns in dnsProviders) {
    println("Testing ${dns.url}")
    for (host in names) {
      print("$host: ")
      System.out.flush()
      try {
        val results = dns.lookup(host)
        println(results)
      } catch (uhe: UnknownHostException) {
        var e: Throwable? = uhe

java.net.Inet6Address#getHostAddress()
java.net.InetSocketAddress#toString()

@defaultMessage avoid DNS lookups by accident: if you have a valid reason, then @SuppressWarnings with that reason so its completely clear
java.net.InetAddress#getHostName()
java.net.InetAddress#getCanonicalHostName()

java.net.InetSocketAddress#getHostName() @ Use getHostString() instead, which avoids a DNS lookup

@defaultMessage Do not violate java's access system

        .build(),
    )
    server.enqueue(MockResponse())
    val dns = FakeDns()
    dns["fakeurl"] = client.dns.lookup(server.hostName)
    dns["www.fakeurl"] = client.dns.lookup(server.hostName)
    client =
      client
        .newBuilder()
        .dns(dns)
        .build()
    val call =
      client.newCallWithListener(
        Request
          .Builder()