.addSubjectAlternativeName("intermediate_ca.com")
        .build()
    serverCert =
      HeldCertificate.Builder()
        .signedBy(serverIntermediateCa)
        .serialNumber(3L)
        .commonName("Local Host")
        .addSubjectAlternativeName(server.hostName)
        .build()
    clientRootCa =
      HeldCertificate.Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .commonName("root")

  fun setup(server: MockWebServer) {
    this.server = server

    // BCX509ExtendedTrustManager not supported in TlsUtil.newTrustManager
    platform.assumeNotBouncyCastle()
  }

  @Test fun `untrusted host in insecureHosts connects successfully`() {
    val serverCertificates = platform.localhostHandshakeCertificates()
    server.useHttps(serverCertificates.sslSocketFactory())
    server.enqueue(MockResponse())

    val encoded = encodeQuery("google.com", TYPE_A)
    assertThat(encoded).isEqualTo("AAABAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ")
  }

  private fun encodeQuery(
    host: String,
    type: Int,
  ): String {
    return DnsRecordCodec.encodeQuery(host, type).base64Url().replace("=", "")
  }

  @Test
  fun testGoogleDotComEncodingWithIPv6() {
    val encoded = encodeQuery("google.com", TYPE_AAAA)

          )
      }

    /**
     * @param host either a regular hostname, International Domain Name, IPv4 address, or IPv6
     * address.
     */
    fun host(host: String) =
      apply {
        val encoded =
          host.percentDecode().toCanonicalHost()
            ?: throw IllegalArgumentException("unexpected host: $host")
        this.host = encoded
      }

    fun port(port: Int) =

    includeIPv6: Boolean,
    post: Boolean = false,
  ): DnsOverHttps {
    val url = server.url("/lookup?ct")
    return DnsOverHttps.Builder().client(bootstrapClient)
      .includeIPv6(includeIPv6)
      .resolvePrivateAddresses(true)
      .url(url)
      .post(post)
      .build()
  }

  companion object {
    private fun address(host: String) = InetAddress.getByName(host)
  }

    @Override public Socket createSocket(
        Socket socket, String host, int port, boolean autoClose) throws IOException {
      return configureSocket((SSLSocket) delegate.createSocket(socket, host, port, autoClose));
    }

    @Override public Socket createSocket(String host, int port) throws IOException {
      return configureSocket((SSLSocket) delegate.createSocket(host, port));
    }

    @Override public Socket createSocket(

      return routes[nextRouteIndex++]
    }
  }

  companion object {
    /** Obtain a host string containing either an actual host name or a numeric IP address. */
    val InetSocketAddress.socketHost: String get() {
      // The InetSocketAddress was specified with a string (either a numeric IP or a host name). If
      // it is a name, all IPs for that name should be tried. If it is an IP address, only that IP

      isDaemon = daemon
    }
  }

internal fun HttpUrl.toHostHeader(includeDefaultPort: Boolean = false): String {
  val host =
    if (":" in host) {
      "[$host]"
    } else {
      host
    }
  return if (includeDefaultPort || port != defaultPort(scheme)) {
    "$host:$port"
  } else {
    host
  }
}

/** Returns a [Locale.US] formatted [String]. */
internal fun format(
  format: String,

    }
    for (existingCall in readyAsyncCalls) {
      if (existingCall.host == host) return existingCall
    }
    return null
  }

  /**
   * Cancel all calls currently enqueued or executing. Includes calls executed both
   * [synchronously][Call.execute] and [asynchronously][Call.enqueue].
   */
  fun cancelAll() {
    this.withLock {
      for (call in readyAsyncCalls) {

/**
 * Android implementation of CertificateChainCleaner using direct Android API calls.
 * Not used if X509TrustManager doesn't implement [X509TrustManager.checkServerTrusted] with
 * an additional host param.
 */
internal class AndroidCertificateChainCleaner(
  private val trustManager: X509TrustManager,
  private val x509TrustManagerExtensions: X509TrustManagerExtensions,
) : CertificateChainCleaner() {