template "minio.fullname" . }}-local=http://$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@localhost:{{ .Values.service.port }} 3. mc ls {{ template "minio.fullname" . }}-local {{- end }} {{- if eq .Values.service.type "LoadBalancer" }} MinIO can be accessed via...

     */
    public byte[] decryptMessage(final byte[] encryptedMessage) throws CIFSException {
        try {
            // Parse transform header
            final Smb2TransformHeader transformHeader = Smb2TransformHeader.decode(encryptedMessage, 0);
            final byte[] associatedData = transformHeader.getAssociatedData();
            byte[] nonce = transformHeader.getNonce();
            final byte[] authTag = transformHeader.getSignature();

  private static final Function<String, String> DECODE_FUNCTION =
      new Function<String, String>() {
        @Override
        public String apply(String input) {
          return new String(BaseEncoding.base64().decode(input), UTF_8);
        }
      };

  private static final EntryTransformer<String, String, String> DECODE_ENTRY_TRANSFORMER =
      new EntryTransformer<String, String, String>() {
        @Override

//
// The stream is s2 compressed.
// https://github.com/klauspost/compress/tree/master/s2#s2-compression
// This ensures integrity and reduces the size typically by at least 50%.
//
// All stream elements are msgpack encoded.
//
// 1 Integer, metacacheStreamVersion of the writer.
// This can be used for managing breaking changes.
//
// For each element:
// 1. Bool. If false at end of stream.

Então, utilizando o certificado, o cliente e o Proxy de Terminação TLS decidem como encriptar o resto da comunicação TCP. Isso completa a parte do Handshake TLS.

  /**
   * End of Medium: A control character associated with the sent data which may be used to identify
   * the physical end of the medium, or the end of the used, or wanted, portion of information
   * recorded on a medium. (The position of this character does not necessarily correspond to the
   * physical end of the medium.)
   *
   * @since 8.0
   */
  public static final byte EM = 25;

  /**

                }
                try {
                    final String encoded = serializeParameters(parameters);
                    if (encoded.length() > fessConfig.getCookieSearchParameterMaxLengthAsInteger()) {
                        logger.warn("Encoded search parameters exceed the maximum cookie length: {} > {}. Skipping cookie storage.",
                                encoded.length(), fessConfig.getCookieSearchParameterMaxLengthAsInteger());

		// same. 'volume not found' usually means its a fresh disk.
		if errors.Is(err, errFileNotFound) || errors.Is(err, errVolumeNotFound) {
			return nil, errUnformattedDisk
		}
		return nil, err
	}

	// Try to decode format json into formatConfigV1 struct.
	format = &formatErasureV3{}
	if err = json.Unmarshal(data, format); err != nil {
		return nil, err
	}

	if heal {

Luego, usando el certificado, el cliente y el TLS Termination Proxy **deciden cómo encriptar** el resto de la **comunicación TCP**. Esto completa la parte de **Handshake TLS**.

 * \r} or {@code \r\n}, do not include the line separator in each line and do not consider there to
 * be an empty line at the end if the contents are terminated with a line separator.
 *
 * <p>Any {@link ByteSource} containing text encoded with a specific {@linkplain Charset character
 * encoding} may be viewed as a {@code CharSource} using {@link ByteSource#asCharSource(Charset)}.
 *