private val nullHostnameVerifier = HostnameVerifier { _: String?, _: SSLSession? -> true }
  private val cookieManager = CookieManager()

  @StartStop
  private val server = MockWebServer()

  @BeforeEach
  fun setUp() {
    platform.assumeNotOpenJSSE()
    server.protocolNegotiationEnabled = false
    val loggingFileSystem = LoggingFilesystem(fileSystem)
    cache = buildCache("/cache/".toPath(), Int.MAX_VALUE.toLong(), loggingFileSystem)

  var client = clientTestRule.newClient()

  @StartStop
  private val server = MockWebServer()

  @BeforeEach
  fun setUp() {
    platform.assumeOpenJSSE()
  }

  @Test
  fun testTlsv13Works() {
    enableTls()

    server.enqueue(MockResponse(body = "abc"))

    val request = Request(server.url("/"))

    val response = client.newCall(request).execute()

    response.use {

      ),
    )
    server.enqueue(MockResponse(body = "This is the new location!"))
    val call = client.newCall(Request(server.url("/")))
    val response = call.execute()
    assertThat(response.body.string()).isEqualTo("This is the new location!")
    val request1 = server.takeRequest()
    assertThat(request1.url.encodedPath).isEqualTo("/")
    val request2 = server.takeRequest()

        .signedBy(rootCa)
        .serialNumber(2L)
        .commonName(server.hostName)
        .addSubjectAlternativeName(server.hostName)
        .addSubjectAlternativeName("san.com")
        .addSubjectAlternativeName("*.wildcard.com")
        .addSubjectAlternativeName("differentdns.com")
        .build()
    serverIps = Dns.SYSTEM.lookup(server.hostName)
    dns[server.hostName] = serverIps
    dns["san.com"] = serverIps

/**
 * Performs either **preemptive** authentication before connecting to a proxy server, or
 * **reactive** authentication after receiving a challenge from either an origin web server or proxy
 * server.
 *
 * ## Preemptive Authentication
 *
 * To make HTTPS calls using an HTTP proxy server OkHttp must first negotiate a connection with
 * the proxy. This proxy connection is called a "TLS Tunnel" and is specified by

  }

  @Test
  fun upgradesOnReusedConnection() {
    server.enqueue(MockResponse(body = "normal request"))
    client.newCall(Request(server.url("/"))).execute().use { response ->
      assertThat(response.body.string()).isEqualTo("normal request")
    }

    upgrade()

    assertThat(server.takeRequest().connectionIndex).isEqualTo(0)
    assertThat(server.takeRequest().connectionIndex).isEqualTo(0)
  }

  @Test

      .Builder()
      .addPlatformTrustedCertificates()
      .addInsecureHost(server.hostName)
      .build()

  val client =
    OkHttpClient
      .Builder()
      .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager)
      .build()

  fun run() {
    try {
      val request = Request(server.url("/"))

      client.newCall(request).execute().use { response ->

 * future frames won't arrive on the stream ID.
 */
interface PushObserver {
  /**
   * Describes the request that the server intends to push a response for.
   *
   * @param streamId server-initiated stream ID: an even number.
   * @param requestHeaders minimally includes `:method`, `:scheme`, `:authority`,
   * and `:path`.
   */
  fun onRequest(
    streamId: Int,

---------------------

The above scenario is representative of most TLS set ups: the client uses certificates to validate
the identity of a server. The converse is also possible. Here we create a server that authenticates
a client and a client that authenticates a server.

```java
// Create the root for client and server to trust. We could also use different roots for each!
HeldCertificate rootCertificate = new HeldCertificate.Builder()

### Server Binaries

filename | sha512 hash
-------- | -----------
[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.33.10/kubernetes-server-linux-amd64.tar.gz) | 96e981cea563505e7b65ce65569d6238ad4b91dd4db5403678ca17ec2e21e693adc87d899e3f7cc2ff900dd3b76ca8fd6d6276d34463f652ffd1b05e900b1876