* migrate between certificate authorities. Do not use certificate pinning without the blessing of
 * your server's TLS administrator!
 *
 * ### Note about self-signed certificates
 *
 * [CertificatePinner] can not be used to pin self-signed certificate if such certificate is not
 * accepted by [javax.net.ssl.TrustManager].
 *
 * See also [OWASP: Certificate and Public Key Pinning][owasp].
 *

## Pull Request Checklist

Before sending your pull requests, make sure you do the following:

-   Read the [contributing guidelines](CONTRIBUTING.md).
-   Read the [Code of Conduct](CODE_OF_CONDUCT.md).
-   Ensure you have signed the
    [Contributor License Agreement (CLA)](https://cla.developers.google.com/).
-   Check if your changes are consistent with the
    [guidelines](#general-guidelines-and-philosophy-for-contribution).

    @Test
    @DisplayName("Test decode with negative values interpreted as unsigned")
    void testDecodeWithNegativeValues() throws SMBProtocolDecodingException {
        // Prepare test data with values that would be negative if signed
        byte[] buffer = new byte[22];
        int idFileSystem = -1; // 0xFFFFFFFF
        int sectPerAlloc = 8;
        int alloc = -100; // Large unsigned value
        int free = -200; // Large unsigned value

    void testSpecialByteValues() {
        // Test boundary values
        byte[] data = { (byte) 0x00, // min value
                (byte) 0xFF, // max value (-1 as signed byte)
                (byte) 0x7F, // max positive
                (byte) 0x80 // min negative
        };

        String result = Hexdump.toHexString(data);
        assertEquals("00FF7F80", result);
    }

        bufferIndex += 4;
        this.server.serverTime = SMBUtil.readTime(buffer, bufferIndex);
        bufferIndex += 8;
        int tzOffset = SMBUtil.readInt2(buffer, bufferIndex);
        // tzOffset is signed!
        if (tzOffset > Short.MAX_VALUE) {
            tzOffset = -1 * (65536 - tzOffset);
        }
        this.server.serverTimeZone = tzOffset;
        bufferIndex += 2;

            int bytesRead = response.readBytesWireFormat(buffer, 0);

            assertEquals(16, bytesRead);
            assertEquals(-1, response.getCount()); // -1 as signed int represents max unsigned value
            assertEquals(-2, response.getRemaining());
        }

        private byte[] createValidWriteResponse(int count, int remaining) {
            byte[] buffer = new byte[64];

      // recordSslDebug = true
    }

  // https://tools.ietf.org/html/rfc6066#page-6 specifies a FQDN is required.
  val hostname = "local.host"
  private val handshakeCertificates =
    run {
      // Generate a self-signed cert for the server to serve and the client to trust.
      val heldCertificate =
        HeldCertificate
          .Builder()
          .commonName(hostname)
          .addSubjectAlternativeName(hostname)

            SmbTransport signed = transportPool.getSmbTransport(context, address, DEFAULT_PORT, false, true);

            // Then
            assertEquals(sharedTransport, shared);
            assertEquals(exclusiveTransport, exclusive);
            assertEquals(signedTransport, signed);
            verify(transportPool).getSmbTransport(context, address, DEFAULT_PORT, false);

The following self-signed certificate is issued for `consoleAdmin`. So, MinIO would associate it with the pre-defined `consoleAdmin` policy.

```
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:

 * signed versions of methods for which signedness is an issue.
 *
 * <p>In addition, this class provides several static methods for converting an {@code int} to a
 * {@code String} and a {@code String} to an {@code int} that treat the {@code int} as an unsigned
 * number.
 *
 * <p>Users of these utilities must be <i>extremely careful</i> not to mix up signed and unsigned